|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � �Z0�v�B���nc����� �B!1I�� �O<��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R
� �Z0�v�B���nc����� �B!1I�� �O<��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.5983106566483025,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "432bb82e15283b9f7e3f6ee6f106bdd9",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdZ0\ufffdv\ufffd\u0002B\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdZ0\ufffdv\ufffd\u0002B\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdZ0\ufffdv\ufffd\u0002B\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdZ0\ufffdv\ufffd\u0002B\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdZ0\ufffdv\ufffd\u0002B\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f40c27c5ef738c6a876eee0900df85ab7c66ea1f",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdZ0\ufffdv\ufffd\u0002B\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\r\ufffd\ufffdZ0\ufffdv\ufffdB\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdZ0\ufffdv\ufffd\u0002B\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\r\ufffd\ufffdZ0\ufffdv\ufffdB\ufffd\ufffd\ufffdnc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R P I� ^�sM� �M����W���WIK��x��B�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R P I�
^�sM� �M����W���WIK��x��B�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.4889967094026995,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "448e2ae93348006e84ffc74b37952120",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0000I\ufffd\r^\ufffdsM\ufffd\u001f\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0000I\ufffd\r^\ufffdsM\ufffd\u001f\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0000I\ufffd\r^\ufffdsM\ufffd\u001f\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0000I\ufffd\r^\ufffdsM\ufffd\u001f\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0000I\ufffd\r^\ufffdsM\ufffd\u001f\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b25e4e4bcf6420eabdef6e3fbed8f4729c1ab85",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0000I\ufffd\r^\ufffdsM\ufffd\u001f\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdRPI\ufffd\r^\ufffdsM\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0000I\ufffd\r^\ufffdsM\ufffd\u001f\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdRPI\ufffd\r^\ufffdsM\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R ' 6��-�C��/\pױ�2��cþA�F-�4 j�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R ' 6��-�C��/\pױ�2��cþA�F-�4 j�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.662140443882346,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b32d5ec724ff04c5c1698639d850211",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u00006\ufffd\ufffd\u000f-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u00006\ufffd\ufffd\u000f-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u00006\ufffd\ufffd\u000f-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u00006\ufffd\ufffd\u000f-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u00006\ufffd\ufffd\u000f-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "387769642a0671de516817dbbf5d902d62d7fe49",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u00006\ufffd\ufffd\u000f-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR'6\ufffd\ufffd-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u00006\ufffd\ufffd\u000f-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR'6\ufffd\ufffd-\ufffdC\ufffd\ufffd\/\\p\u05f1\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R "� �鼉�CL���� )�� �@q��G��X�vni�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R "� �鼉�CL����
)�� �@q��G��X�vni�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.619587252392983,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d40007d7882c2c35027c2223cda02ab9",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\u9f09\ufffdC\bL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\u9f09\ufffdC\bL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\u9f09\ufffdC\bL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\u9f09\ufffdC\bL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\u9f09\ufffdC\bL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9e310a9c535ab4acd7a643adde4648c08164b88",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\u9f09\ufffdC\bL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\"\ufffd\ufffd\u9f09\ufffdCL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\u9f09\ufffdC\bL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\"\ufffd\ufffd\u9f09\ufffdCL\ufffd\ufffd\ufffd\ufffd\r)\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R Lf�"��j@�O5?0��lL歽rvA�U�X�m*�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R Lf�"��j@�O5?0��lL歽rvA�U�X�m*�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.619587252392983,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "332f215cbe989006340e15d9222849b4",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000Lf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000Lf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000Lf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000Lf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000Lf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ccf71520d2f2ff3993a4c4f97ff648925ca28c67",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000Lf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdRLf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7drvA\ufffdU\ufffdX\ufffdm*\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000Lf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdRLf\ufffd\"\ufffd\ufffdj@\ufffdO5?0\ufffd\ufffdlL\u6b7drvA\ufffdU\ufffdX\ufffdm*\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � D�?qL�A���k�va���w�M����� �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � D�?qL�A���k�va���w�M����� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.577034060903622,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2fd99b34663a4bc361e4164d3be95f1",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000D\u0012\ufffd?qL\ufffdA\ufffd\ufffd\u0003\ufffdk\ufffdva\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000D\u0012\ufffd?qL\ufffdA\ufffd\ufffd\u0003\ufffdk\ufffdva\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000D\u0012\ufffd?qL\ufffdA\ufffd\ufffd\u0003\ufffdk\ufffdva\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000D\u0012\ufffd?qL\ufffdA\ufffd\ufffd\u0003\ufffdk\ufffdva\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000D\u0012\ufffd?qL\ufffdA\ufffd\ufffd\u0003\ufffdk\ufffdva\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33eda13b1949fe3738f686829e00cbf3e56adc94",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000D\u0012\ufffd?qL\ufffdA\ufffd\ufffd\u0003\ufffdk\ufffdva\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdD\ufffd?qL\ufffdA\ufffd\ufffd\ufffdk\ufffdva\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000D\u0012\ufffd?qL\ufffdA\ufffd\ufffd\u0003\ufffdk\ufffdva\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdD\ufffd?qL\ufffdA\ufffd\ufffd\ufffdk\ufffdva\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � �-9x2�M��%tS��P�B � �K�;�}7�7 �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � �-9x2�M��%tS��P�B
� �K�;�}7�7 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.619587252392984,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "89c3ff6e8990712ef8faf2e869a3d1a8",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd-9x2\ufffd\u0018M\ufffd\b\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd-9x2\ufffd\u0018M\ufffd\b\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd-9x2\ufffd\u0018M\ufffd\b\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd-9x2\ufffd\u0018M\ufffd\b\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd-9x2\ufffd\u0018M\ufffd\b\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c419a6f4d5572308446659edc9458e24bae2284c",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd-9x2\ufffd\u0018M\ufffd\b\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd-9x2\ufffdM\ufffd\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd-9x2\ufffd\u0018M\ufffd\b\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd-9x2\ufffdM\ufffd\ufffd%tS\ufffd\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � ��X}�mD�ț��"� !��XM�F� ؎��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � ��X}�mD�ț��"� !��XM�F�
؎��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.5983106566483025,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f109bde711db915fe83efb63d375429",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0012\ufffd\ufffdX}\ufffdmD\ufffd\u021b\u0016\ufffd\ufffd\"\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0012\ufffd\ufffdX}\ufffdmD\ufffd\u021b\u0016\ufffd\ufffd\"\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0012\ufffd\ufffdX}\ufffdmD\ufffd\u021b\u0016\ufffd\ufffd\"\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0012\ufffd\ufffdX}\ufffdmD\ufffd\u021b\u0016\ufffd\ufffd\"\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0012\ufffd\ufffdX}\ufffdmD\ufffd\u021b\u0016\ufffd\ufffd\"\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d3f84a57a6987c223da56267d6f3e2b940b1f5c",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0012\ufffd\ufffdX}\ufffdmD\ufffd\u021b\u0016\ufffd\ufffd\"\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\ufffdX}\ufffdmD\ufffd\u021b\ufffd\ufffd\"\ufffd!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0012\ufffd\ufffdX}\ufffdmD\ufffd\u021b\u0016\ufffd\ufffd\"\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\ufffdX}\ufffdmD\ufffd\u021b\ufffd\ufffd\"\ufffd!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R @ ���R�H��@�N��0�y���ԳH�j�ց沱
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R @ ���R�H��@�N��0�y���ԳH�j�ց沱
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.526450151306138,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "aa9fb7c6545eb23038655330b6abcb86",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\u0006\ufffdR\ufffd\u0011H\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb1\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\u0006\ufffdR\ufffd\u0011H\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb1\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\u0006\ufffdR\ufffd\u0011H\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb1\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\u0006\ufffdR\ufffd\u0011H\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb1\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\u0006\ufffdR\ufffd\u0011H\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb1\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cfffc4f162ebbedd1b38fcf7c65d2af750ed541b",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\u0006\ufffdR\ufffd\u0011H\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb1\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR@\ufffd\ufffd\ufffdR\ufffdH\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb1",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\u0006\ufffdR\ufffd\u0011H\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb1\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR@\ufffd\ufffd\ufffdR\ufffdH\ufffd\ufffd@\ufffdN\ufffd\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb1",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R %� Y��W��QB��`�� ����J��L�����ͅ�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R %� Y��W��QB��`�� ����J��L�����ͅ�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.480965991294579,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8d474972ea01aa86d10d37c30c6514b6",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000Y\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd\u0006`\ufffd\u0003\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000Y\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd\u0006`\ufffd\u0003\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000Y\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd\u0006`\ufffd\u0003\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000Y\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd\u0006`\ufffd\u0003\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000Y\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd\u0006`\ufffd\u0003\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d064435b428d72f5052999a8d4d9f5fe91d9891",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000Y\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd\u0006`\ufffd\u0003\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR%\ufffdY\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000Y\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd\u0006`\ufffd\u0003\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR%\ufffdY\ufffd\ufffdW\ufffd\ufffdQB\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � Q�w�yE�'��r~ *���dd_�D�����,N��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � Q�w�yE�'��r~ *���dd_�D�����,N��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.577034060903621,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "770947f954923ed2712a354c317ccfc6",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000Q\ufffd\u0005\u0002w\ufffdyE\ufffd'\ufffd\ufffdr~\u001d*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000Q\ufffd\u0005\u0002w\ufffdyE\ufffd'\ufffd\ufffdr~\u001d*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000Q\ufffd\u0005\u0002w\ufffdyE\ufffd'\ufffd\ufffdr~\u001d*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000Q\ufffd\u0005\u0002w\ufffdyE\ufffd'\ufffd\ufffdr~\u001d*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000Q\ufffd\u0005\u0002w\ufffdyE\ufffd'\ufffd\ufffdr~\u001d*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad142dde2a844163b917c234ec8c37bc91650517",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000Q\ufffd\u0005\u0002w\ufffdyE\ufffd'\ufffd\ufffdr~\u001d*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdQ\ufffdw\ufffdyE\ufffd'\ufffd\ufffdr~*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000Q\ufffd\u0005\u0002w\ufffdyE\ufffd'\ufffd\ufffdr~\u001d*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdQ\ufffdw\ufffdyE\ufffd'\ufffd\ufffdr~*\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � ��B6D�O�`1n�x��&R\��7K��#h�._�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � ��B6D�O�`1n�x��&R\��7K��#h�._�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.662140443882345,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "241c26e9900458c4d5ea31544fbd9d63",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5fd40d09d7d76e3708e7c165847bf9130c9c8247",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\ufffdB6D\ufffdO\ufffd`1n\ufffdx\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R *d ��M��q[�ƈ�G4��D~?K�KiSY?�[�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R *d ��M��q[�ƈ�G4��D~?K�KiSY?�[�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.598310656648304,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9267d8a9db9fb1787d8f06c789c7e682",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\uf756\ufffd\u0007\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\uf756\ufffd\u0007\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\uf756\ufffd\u0007\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\uf756\ufffd\u0007\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\uf756\ufffd\u0007\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b66373cf7975235cbebfdca3eebab137930e07dc",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\uf756\ufffd\u0007\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR*d\uf756\ufffd\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\uf756\ufffd\u0007\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR*d\uf756\ufffd\ufffdM\ufffd\ufffdq[\ufffd\u0188\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R OMNT�[+N��Cм_e k���@��n��z���
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R OMNT�[+N��Cм_e k���@��n��z���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.619587252392984,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5843372984a9d2595126b8487755827c",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000OMNT\ufffd[+N\ufffd\u008b\ufffdC\u0018\u043c_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000OMNT\ufffd[+N\ufffd\u008b\ufffdC\u0018\u043c_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000OMNT\ufffd[+N\ufffd\u008b\ufffdC\u0018\u043c_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000OMNT\ufffd[+N\ufffd\u008b\ufffdC\u0018\u043c_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000OMNT\ufffd[+N\ufffd\u008b\ufffdC\u0018\u043c_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "136de040553c4ba6df568f920323171e46447971",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000OMNT\ufffd[+N\ufffd\u008b\ufffdC\u0018\u043c_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdROMNT\ufffd[+N\ufffd\u008b\ufffdC\u043c_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000OMNT\ufffd[+N\ufffd\u008b\ufffdC\u0018\u043c_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdROMNT\ufffd[+N\ufffd\u008b\ufffdC\u043c_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R *� ��й�J� ݎ��t�΅h�AH��dt� �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R *� ��й�J� ݎ��t�΅h�AH��dt� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.585064779011744,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a84aea7ee1006169cdcb7385ae3811f",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\u0004\ufffd\ufffd\u0439\ufffd\u0010J\ufffd\u000b\u074e\ufffd\ufffdt\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\u0004\ufffd\ufffd\u0439\ufffd\u0010J\ufffd\u000b\u074e\ufffd\ufffdt\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\u0004\ufffd\ufffd\u0439\ufffd\u0010J\ufffd\u000b\u074e\ufffd\ufffdt\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\u0004\ufffd\ufffd\u0439\ufffd\u0010J\ufffd\u000b\u074e\ufffd\ufffdt\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\u0004\ufffd\ufffd\u0439\ufffd\u0010J\ufffd\u000b\u074e\ufffd\ufffdt\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac042427d4d1d35518ffe7aebe0b4bdc24ea0fc4",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\u0004\ufffd\ufffd\u0439\ufffd\u0010J\ufffd\u000b\u074e\ufffd\ufffdt\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR*\ufffd\ufffd\ufffd\u0439\ufffdJ\ufffd\u074e\ufffd\ufffdt\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\u0004\ufffd\ufffd\u0439\ufffd\u0010J\ufffd\u000b\u074e\ufffd\ufffdt\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR*\ufffd\ufffd\ufffd\u0439\ufffdJ\ufffd\u074e\ufffd\ufffdt\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R | ��� �-L�}d ��@4��eh�B����M�n8�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R | ��� �-L�}d ��@4��eh�B����M�n8�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.619587252392983,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d3e7197b6a3c3bc5c20a1ebbceecdb2",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd\ufffd\u000b\u0005\ufffd-L\ufffd\u0019}d\t\ufffd\ufffd@4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd\ufffd\u000b\u0005\ufffd-L\ufffd\u0019}d\t\ufffd\ufffd@4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd\ufffd\u000b\u0005\ufffd-L\ufffd\u0019}d\t\ufffd\ufffd@4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd\ufffd\u000b\u0005\ufffd-L\ufffd\u0019}d\t\ufffd\ufffd@4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd\ufffd\u000b\u0005\ufffd-L\ufffd\u0019}d\t\ufffd\ufffd@4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2bdeccc524a2ca37281b592a5192c7ad2e660f8a",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd\ufffd\u000b\u0005\ufffd-L\ufffd\u0019}d\t\ufffd\ufffd@4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR|\ufffd\ufffd\ufffd\ufffd-L\ufffd}d\t\ufffd\ufffd@4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd\ufffd\u000b\u0005\ufffd-L\ufffd\u0019}d\t\ufffd\ufffd@4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR|\ufffd\ufffd\ufffd\ufffd-L\ufffd}d\t\ufffd\ufffd@4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � �/�|��I�C�Q�ↈ�.�C��E��2��F��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � �/�|��I�C�Q�ↈ�.�C��E��2��F��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.640863848137664,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a15a8edc92f94f34f52951b9aa7a8a35",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\/\ufffd\u000f|\ufffd\ufffdI\ufffdC\u0015\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\/\ufffd\u000f|\ufffd\ufffdI\ufffdC\u0015\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\/\ufffd\u000f|\ufffd\ufffdI\ufffdC\u0015\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\/\ufffd\u000f|\ufffd\ufffdI\ufffdC\u0015\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\/\ufffd\u000f|\ufffd\ufffdI\ufffdC\u0015\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a948958f7a95e1cc39b161821b52d08105cb72d0",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\/\ufffd\u000f|\ufffd\ufffdI\ufffdC\u0015\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR \ufffd\ufffd\/\ufffd|\ufffd\ufffdI\ufffdC\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\/\ufffd\u000f|\ufffd\ufffdI\ufffdC\u0015\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR \ufffd\ufffd\/\ufffd|\ufffd\ufffdI\ufffdC\ufffdQ\ufffd\u2188\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � lN�i���O���a���ϡL�b�E� K�� ϰ
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � lN�i���O���a���ϡL�b�E� K��
ϰ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.640863848137664,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1429291058b934d45f5c72defec23210",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000lN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\u0016\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f0\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000lN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\u0016\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f0\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000lN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\u0016\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f0\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000lN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\u0016\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f0\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000lN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\u0016\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f0\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bfe8fba04725b9e8a690fd4b52fb6b376aad6689",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000lN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\u0016\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f0\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdlN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03f0",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000lN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\u0016\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f0\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdlN\ufffdi\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03f0",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R 4 PZ � ��L����62r6 �k�IwM�I�yT��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R 4 PZ �
��L����62r6
�k�IwM�I�yT��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.460380156893202,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f96368f48ce142becc2f91c13d89587a",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000PZ\u0000\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000PZ\u0000\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000PZ\u0000\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000PZ\u0000\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000PZ\u0000\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5af7550ea35098a690f46855364de306d5cc0c66",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000PZ\u0000\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR4PZ\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000PZ\u0000\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR4PZ\ufffd\n\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd62r6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R )l v���o2@� �/qD�I� �RH���AK����
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R )l v���o2@� �/qD�I� �RH���AK����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.519110194541322,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "aeeba9f5a42d3e401df6aba42691bcb7",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000v\ufffd\ufffd\u0002\ufffdo2@\ufffd\u001c\ufffd\/\u0017qD\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000v\ufffd\ufffd\u0002\ufffdo2@\ufffd\u001c\ufffd\/\u0017qD\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000v\ufffd\ufffd\u0002\ufffdo2@\ufffd\u001c\ufffd\/\u0017qD\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000v\ufffd\ufffd\u0002\ufffdo2@\ufffd\u001c\ufffd\/\u0017qD\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000v\ufffd\ufffd\u0002\ufffdo2@\ufffd\u001c\ufffd\/\u0017qD\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a5d71e0ee8f9bb35a9670f033701a175e60a825",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000v\ufffd\ufffd\u0002\ufffdo2@\ufffd\u001c\ufffd\/\u0017qD\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR)lv\ufffd\ufffd\ufffdo2@\ufffd\ufffd\/qD\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000v\ufffd\ufffd\u0002\ufffdo2@\ufffd\u001c\ufffd\/\u0017qD\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR)lv\ufffd\ufffd\ufffdo2@\ufffd\ufffd\/qD\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � �F�FD��oLe����dd_�D�����,N��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � �F�FD��oLe����dd_�D�����,N��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.577034060903621,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0414e7dde88691070ed08b7e340b1037",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0011\ufffdF\u000e\ufffdF\u0002D\ufffd\ufffdo\u000fLe\ufffd\u0019\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0011\ufffdF\u000e\ufffdF\u0002D\ufffd\ufffdo\u000fLe\ufffd\u0019\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0011\ufffdF\u000e\ufffdF\u0002D\ufffd\ufffdo\u000fLe\ufffd\u0019\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0011\ufffdF\u000e\ufffdF\u0002D\ufffd\ufffdo\u000fLe\ufffd\u0019\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0011\ufffdF\u000e\ufffdF\u0002D\ufffd\ufffdo\u000fLe\ufffd\u0019\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23cb94310b3dd2e91fe491d259da0fc82dcd9555",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0011\ufffdF\u000e\ufffdF\u0002D\ufffd\ufffdo\u000fLe\ufffd\u0019\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffdF\ufffdFD\ufffd\ufffdoLe\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0011\ufffdF\u000e\ufffdF\u0002D\ufffd\ufffdo\u000fLe\ufffd\u0019\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffdF\ufffdFD\ufffd\ufffdoLe\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � ��m�̌@����E?��� �B!1I�� �O<��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R
� ��m�̌@����E?��� �B!1I�� �O<��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.640863848137664,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fd22b25e07d284554b304a883c35d351",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffdm\ufffd\u0018\u030c@\ufffd\ufffd\b\ufffd\ufffdE?\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffdm\ufffd\u0018\u030c@\ufffd\ufffd\b\ufffd\ufffdE?\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffdm\ufffd\u0018\u030c@\ufffd\ufffd\b\ufffd\ufffdE?\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffdm\ufffd\u0018\u030c@\ufffd\ufffd\b\ufffd\ufffdE?\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffdm\ufffd\u0018\u030c@\ufffd\ufffd\b\ufffd\ufffdE?\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44fd24d3f1d90e1a7e47b0be53db8c6281d7c40f",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffdm\ufffd\u0018\u030c@\ufffd\ufffd\b\ufffd\ufffdE?\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\r\ufffd\ufffd\ufffdm\ufffd\u030c@\ufffd\ufffd\ufffd\ufffdE?\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffdm\ufffd\u0018\u030c@\ufffd\ufffd\b\ufffd\ufffdE?\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\r\ufffd\ufffd\ufffdm\ufffd\u030c@\ufffd\ufffd\ufffd\ufffdE?\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R &T ��Zt��D�8�*CP8�m �h �D�E�LK$�˯
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R &T ��Zt��D�8�*CP8�m �h �D�E�LK$�˯
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.539696028942697,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f2325e9d6a6ed8d6462875dac9174b25",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\u001a\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ef\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\u001a\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ef\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\u001a\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ef\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\u001a\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ef\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\u001a\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ef\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72e5ed41cc5e11a2fc057db3a1da92361628f65e",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\u001a\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ef\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR&T\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02ef",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\u001a\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ef\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR&T\ufffd\ufffdZt\ufffd\ufffdD\ufffd8\ufffd*CP8\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02ef",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � �ؾ��I��w��=� ���w�M����� �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � �ؾ��I��w��=� ���w�M����� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.560972624687378,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3bbac49e5e773874929e25165f0788c3",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\u001a\ufffd\u063e\ufffd\ufffd\u0006I\ufffd\ufffdw\ufffd\ufffd=\ufffd\u000b\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\u001a\ufffd\u063e\ufffd\ufffd\u0006I\ufffd\ufffdw\ufffd\ufffd=\ufffd\u000b\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\u001a\ufffd\u063e\ufffd\ufffd\u0006I\ufffd\ufffdw\ufffd\ufffd=\ufffd\u000b\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\u001a\ufffd\u063e\ufffd\ufffd\u0006I\ufffd\ufffdw\ufffd\ufffd=\ufffd\u000b\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\u001a\ufffd\u063e\ufffd\ufffd\u0006I\ufffd\ufffdw\ufffd\ufffd=\ufffd\u000b\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "924108e7d91b6697edbb421e681151621a54ba05",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\u001a\ufffd\u063e\ufffd\ufffd\u0006I\ufffd\ufffdw\ufffd\ufffd=\ufffd\u000b\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\u063e\ufffd\ufffdI\ufffd\ufffdw\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\u001a\ufffd\u063e\ufffd\ufffd\u0006I\ufffd\ufffdw\ufffd\ufffd=\ufffd\u000b\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\u063e\ufffd\ufffdI\ufffd\ufffdw\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � U�\��B�ʘ�8E�P�B � �K�;�}7�7 �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � U�\��B�ʘ�8E�P�B
� �K�;�}7�7 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.505173555561458,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6a2ffcfaf309e98715c7fd5712e6d1ec",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000U\ufffd\u0012\b\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffd\u0003P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000U\ufffd\u0012\b\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffd\u0003P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000U\ufffd\u0012\b\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffd\u0003P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000U\ufffd\u0012\b\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffd\u0003P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000U\ufffd\u0012\b\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffd\u0003P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b40b455c0582cf3fdeec0d7be0f456add1abefb",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000U\ufffd\u0012\b\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffd\u0003P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdU\ufffd\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000U\ufffd\u0012\b\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffd\u0003P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdU\ufffd\\\ufffd\ufffdB\ufffd\u0298\ufffd8E\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R *d �v�P���J��u�����G4��D~?K�KiSY?�[�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R *d �v�P���J��u�����G4��D~?K�KiSY?�[�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.619587252392986,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d07866404e20e048ca36cb94850d9172",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b796e91bd2f4f2747dfde0dd6e57e3fe0d596ab",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR*d\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*d\u0000\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR*d\ufffdv\ufffdP\ufffd\ufffd\ufffdJ\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R 4 �%�{� I�v�@J��6 �k�IwM�I�yT��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R 4 �%�{�
I�v�@J��6
�k�IwM�I�yT��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.561663386030682,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d392596ac26efbf539b4d64ece78e750",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e44f5c4c2e9cee5663aa8d09e00ad1294eca23e7",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR4\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR4\ufffd%\ufffd{\ufffd\rI\ufffdv\ufffd@J\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R )l @�Zf:��C�N�-p�9�I� �RH���AK����
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R )l @�Zf:��C�N�-p�9�I� �RH���AK����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.527140912649444,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b2c778146c3cd6bacc75838a5ba1dad0",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6effd18744fb2286b7995a7dbb1b8678695f860",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR)l@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR)l@\ufffdZf:\ufffd\ufffdC\ufffdN\ufffd-p\ufffd9\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � a�^ oI�u� e7;�ϡL�b�E� K�� Ϯ
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � a�^ oI�u� e7;�ϡL�b�E� K��
Ϯ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.569694104138804,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7d560f2392dbfe83981e9cf286888188",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000a\ufffd\u000e^ \u0001oI\ufffdu\ufffd\u001ee7;\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ee\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000a\ufffd\u000e^ \u0001oI\ufffdu\ufffd\u001ee7;\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ee\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000a\ufffd\u000e^ \u0001oI\ufffdu\ufffd\u001ee7;\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ee\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000a\ufffd\u000e^ \u0001oI\ufffdu\ufffd\u001ee7;\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ee\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000a\ufffd\u000e^ \u0001oI\ufffdu\ufffd\u001ee7;\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ee\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efca45fdacaddebe6f780f2fae12f851e1da7c4e",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000a\ufffd\u000e^ \u0001oI\ufffdu\ufffd\u001ee7;\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ee\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffda\ufffd^ oI\ufffdu\ufffde7;\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03ee",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000a\ufffd\u000e^ \u0001oI\ufffdu\ufffd\u001ee7;\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ee\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffda\ufffd^ oI\ufffdu\ufffde7;\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03ee",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � 7�����TH�n_Crš��.�C��E��2��F��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � 7�����TH�n_Crš��.�C��E��2��F��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.662140443882345,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7c338966aaf341ea3394c736a9d1a807",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u00007\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\b\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u00007\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\b\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u00007\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\b\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u00007\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\b\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u00007\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\b\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58f81310e10f953353af3ba78e748e39d585d3a4",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u00007\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\b\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR \ufffd7\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u00007\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\b\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR \ufffd7\ufffd\ufffd\ufffd\ufffd\ufffdTH\ufffdn_Cr\u0161\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R *� �"�ʇ%\O���_��΅h�AH��dt� �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R *� �"�ʇ%\O���_��΅h�AH��dt� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.5983106566483025,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae97e1c9d911237e407dcc498dac780e",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\u0003\u001b\ufffd_\ufffd\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\u0003\u001b\ufffd_\ufffd\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\u0003\u001b\ufffd_\ufffd\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\u0003\u001b\ufffd_\ufffd\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\u0003\u001b\ufffd_\ufffd\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49264f77fb60597f86aaf09d2f576a5952c9154a",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\u0003\u001b\ufffd_\ufffd\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR*\ufffd\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\ufffd_\ufffd\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*\ufffd\u0000\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\u0003\u001b\ufffd_\ufffd\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR*\ufffd\ufffd\"\ufffd\u0287%\\O\ufffd\ufffd\ufffd_\ufffd\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R i�k�8/F�� �>��_e k���@��n��z���
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R i�k�8/F��
�>��_e k���@��n��z���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.611556534284862,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0f2a1e900f08e10aee68cd8c107a3070",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\bi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd\u0012_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\bi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd\u0012_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\bi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd\u0012_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\bi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd\u0012_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\bi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd\u0012_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16f14499dbdfa66923faf806a8437d275bbb1bf3",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\bi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd\u0012_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdRi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\bi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd\u0012_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdRi\ufffdk\ufffd8\/F\ufffd\ufffd\n\ufffd>\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R | �� I�sI��U,Q4��eh�B����M�n8�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R | �� I�sI��U,Q4��eh�B����M�n8�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.53448086941426,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b7c82e2ac577423c58babdae1720b159",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd \u000bI\ufffdsI\ufffd\ufffdU,\u0002Q\u05f54\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd \u000bI\ufffdsI\ufffd\ufffdU,\u0002Q\u05f54\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd \u000bI\ufffdsI\ufffd\ufffdU,\u0002Q\u05f54\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd \u000bI\ufffdsI\ufffd\ufffdU,\u0002Q\u05f54\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd \u000bI\ufffdsI\ufffd\ufffdU,\u0002Q\u05f54\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "625ae8f949cc16032005743049605abdc93c3d34",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd \u000bI\ufffdsI\ufffd\ufffdU,\u0002Q\u05f54\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR|\ufffd\ufffd I\ufffdsI\ufffd\ufffdU,Q\u05f54\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e|\u0000\ufffd\ufffd \u000bI\ufffdsI\ufffd\ufffdU,\u0002Q\u05f54\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR|\ufffd\ufffd I\ufffdsI\ufffd\ufffdU,Q\u05f54\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � 8�;a �EI���nR u�&R\��7K��#h�._�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � 8�;a �EI���nR u�&R\��7K��#h�._�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.523519182783939,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "de04fc720876d3eb1978f2bc3dc90908",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u00008\ufffd;a \ufffdEI\ufffd\ufffd\ufffd\u001anR\u0000u\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u00008\ufffd;a \ufffdEI\ufffd\ufffd\ufffd\u001anR\u0000u\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u00008\ufffd;a \ufffdEI\ufffd\ufffd\ufffd\u001anR\u0000u\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u00008\ufffd;a \ufffdEI\ufffd\ufffd\ufffd\u001anR\u0000u\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u00008\ufffd;a \ufffdEI\ufffd\ufffd\ufffd\u001anR\u0000u\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c88381beeddd43c743317726be21e324d368b2ef",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u00008\ufffd;a \ufffdEI\ufffd\ufffd\ufffd\u001anR\u0000u\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd8\ufffd;a \ufffdEI\ufffd\ufffd\ufffdnRu\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u00008\ufffd;a \ufffdEI\ufffd\ufffd\ufffd\u001anR\u0000u\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd8\ufffd;a \ufffdEI\ufffd\ufffd\ufffdnRu\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R P ����/{K�E$���4W���WIK��x��B�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R P ����/{K�E$���4W���WIK��x��B�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.5902799385401805,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48de1878e35355e410e9d4f0a6baf222",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\ufffd\u0018\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\u001a\ufffd\ufffd4W\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\ufffd\u0018\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\u001a\ufffd\ufffd4W\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\ufffd\u0018\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\u001a\ufffd\ufffd4W\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\ufffd\u0018\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\u001a\ufffd\ufffd4W\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\ufffd\u0018\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\u001a\ufffd\ufffd4W\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6a7f0c50cf560f2b0436f31a7cb2bf51746f858",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\ufffd\u0018\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\u001a\ufffd\ufffd4W\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdRP\ufffd\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\ufffd\ufffd4W\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\ufffd\u0018\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\u001a\ufffd\ufffd4W\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdRP\ufffd\ufffd\ufffd\ufffd\/{K\ufffdE$\ufffd\ufffd\ufffd4W\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � 8"�o��E���V����1� �wH�����9�7�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � 8"�o��E���V����1� �wH�����9�7�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.611556534284862,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "710830adbc49063b897d132a62967ee4",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u00008\u0012\"\ufffdo\ufffd\ufffdE\ufffd\u0013\ufffd\u000f\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u00008\u0012\"\ufffdo\ufffd\ufffdE\ufffd\u0013\ufffd\u000f\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u00008\u0012\"\ufffdo\ufffd\ufffdE\ufffd\u0013\ufffd\u000f\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u00008\u0012\"\ufffdo\ufffd\ufffdE\ufffd\u0013\ufffd\u000f\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u00008\u0012\"\ufffdo\ufffd\ufffdE\ufffd\u0013\ufffd\u000f\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f28a195de6b10ef2be39ca3e2987d3bf79755390",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u00008\u0012\"\ufffdo\ufffd\ufffdE\ufffd\u0013\ufffd\u000f\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd8\"\ufffdo\ufffd\ufffdE\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u00008\u0012\"\ufffdo\ufffd\ufffdE\ufffd\u0013\ufffd\u000f\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd8\"\ufffdo\ufffd\ufffdE\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R "< i��( F��̻:�znDq��x�L��,Pf��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R "< i��( F��̻:�znDq��x�L��,Pf��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.662140443882345,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b3086f116467a8274fcc7f81ecbb89c6",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000i\ufffd\u0007\ufffd(\u001cF\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000i\ufffd\u0007\ufffd(\u001cF\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000i\ufffd\u0007\ufffd(\u001cF\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000i\ufffd\u0007\ufffd(\u001cF\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000i\ufffd\u0007\ufffd(\u001cF\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c584857553d452948a6bc2dd93384b7f489f301a",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000i\ufffd\u0007\ufffd(\u001cF\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\"<i\ufffd\ufffd(F\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000i\ufffd\u0007\ufffd(\u001cF\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\"<i\ufffd\ufffd(F\ufffd\ufffd\u033b:\ufffdznDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R �]�@e��H�|I�'�)�L歽rvA�U�X�m*�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R �]�@e��H�|I�'�)�L歽rvA�U�X�m*�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.662140443882345,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7dbbd7ad6211c39c18721856f28976f5",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c05786df28e81a4516c7e76f7d3a44d1dc28cf4f",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm*\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm*\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd]\ufffd@e\ufffd\ufffdH\ufffd|I\ufffd'\ufffd)\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm*\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R *4 A>��� C�1k� �[���kepqC�NS,�K�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R *4 A>��� C�1k� �[���kepqC�NS,�K�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.47655700305196,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01c89f03c9789a1ffdb6e00d49318019",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*4\u0000A>\u0006\ufffd\ufffd\ufffd\fC\ufffd1k\ufffd\u000b\ufffd[\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*4\u0000A>\u0006\ufffd\ufffd\ufffd\fC\ufffd1k\ufffd\u000b\ufffd[\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*4\u0000A>\u0006\ufffd\ufffd\ufffd\fC\ufffd1k\ufffd\u000b\ufffd[\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*4\u0000A>\u0006\ufffd\ufffd\ufffd\fC\ufffd1k\ufffd\u000b\ufffd[\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*4\u0000A>\u0006\ufffd\ufffd\ufffd\fC\ufffd1k\ufffd\u000b\ufffd[\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f18390bcb86c7ecf3fe1379f085bc3b2ab3e566a",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*4\u0000A>\u0006\ufffd\ufffd\ufffd\fC\ufffd1k\ufffd\u000b\ufffd[\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR*4A>\ufffd\ufffd\ufffdC\ufffd1k\ufffd\ufffd[\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000*4\u0000A>\u0006\ufffd\ufffd\ufffd\fC\ufffd1k\ufffd\u000b\ufffd[\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR*4A>\ufffd\ufffd\ufffdC\ufffd1k\ufffd\ufffd[\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R &T ���Y<%O�Q_���m �h �D�E�LK$�˰
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R &T ���Y<%O�Q_���m �h �D�E�LK$�˰
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.62480241192142,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2dfea8626939b2947548fc011d51ff68",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffdY<%\u0011O\ufffdQ_\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f0\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffdY<%\u0011O\ufffdQ_\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f0\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffdY<%\u0011O\ufffdQ_\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f0\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffdY<%\u0011O\ufffdQ_\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f0\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffdY<%\u0011O\ufffdQ_\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f0\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8280b8bdb34ac761798996aa26c362e76b752ff4",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffdY<%\u0011O\ufffdQ_\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f0\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR&T\ufffd\ufffd\ufffdY<%O\ufffdQ_\ufffd\ufffd\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f0",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffdY<%\u0011O\ufffdQ_\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f0\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR&T\ufffd\ufffd\ufffdY<%O\ufffdQ_\ufffd\ufffd\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f0",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � �g���4sE�-��}.�w�� �B!1I�� �O<��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R
� �g���4sE�-��}.�w�� �B!1I�� �O<��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.683417039627026,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5a4cf5ba06c3cf0de6cf5c126d2edc4f",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c7cb7c3dab2e300d525d630437dc4def61bfa80",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\r\ufffd\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\r\ufffd\ufffdg\ufffd\ufffd\ufffd4sE\ufffd-\ufffd\ufffd}.\ufffdw\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R 8 ����.KD��H��)���(�v�LN�&�(�/6�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R 8 ����.KD��H��)���(�v�LN�&�(�/6�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.606341374756425,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9087a0e08d90a9b431d0ef24775c6d65",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\u0004\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\u0004\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\u0004\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\u0004\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\u0004\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "920e380d30c06aa192e120ab4d6752b5516d8127",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\u0004\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR8\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\u0004\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR8\ufffd\ufffd\ufffd\ufffd.KD\ufffd\ufffdH\ufffd\ufffd)\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R "� �D�N���N�4�`���� �@q��G��X�vni�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R "� �D�N���N�4�`���� �@q��G��X�vni�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.662140443882345,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a88e9e90ca6077f109892b6a2a5dad13",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\u0015\ufffd`\ufffd\ufffd\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\u0015\ufffd`\ufffd\ufffd\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\u0015\ufffd`\ufffd\ufffd\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\u0015\ufffd`\ufffd\ufffd\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\u0015\ufffd`\ufffd\ufffd\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b5fcf4c119d0d4f6166d9e7081fdf0c221e4a9d",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\u0015\ufffd`\ufffd\ufffd\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\"\ufffd\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\u0015\ufffd`\ufffd\ufffd\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\"\ufffd\ufffdD\ufffdN\ufffd\ufffd\ufffdN\ufffd4\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R ' �� �M�J���<� $M2��cþA�F-�4 j�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R ' �� �M�J���<� $M2��cþA�F-�4 j�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.590279938540181,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f4da7c72ac58be4d82ea72067e0767b8",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\ufffd\u001e\ufffd\u0019M\ufffdJ\ufffd\ufffd\ufffd<\ufffd\f$M2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\ufffd\u001e\ufffd\u0019M\ufffdJ\ufffd\ufffd\ufffd<\ufffd\f$M2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\ufffd\u001e\ufffd\u0019M\ufffdJ\ufffd\ufffd\ufffd<\ufffd\f$M2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\ufffd\u001e\ufffd\u0019M\ufffdJ\ufffd\ufffd\ufffd<\ufffd\f$M2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\ufffd\u001e\ufffd\u0019M\ufffdJ\ufffd\ufffd\ufffd<\ufffd\f$M2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26636afc04a5d97f12fddd08a725985b6d1187ff",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\ufffd\u001e\ufffd\u0019M\ufffdJ\ufffd\ufffd\ufffd<\ufffd\f$M2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR'\ufffd\ufffd\ufffdM\ufffdJ\ufffd\ufffd\ufffd<\ufffd$M2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\ufffd\u001e\ufffd\u0019M\ufffdJ\ufffd\ufffd\ufffd<\ufffd\f$M2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR'\ufffd\ufffd\ufffdM\ufffdJ\ufffd\ufffd\ufffd<\ufffd$M2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � � �׀�BJ�8��0�)����w�M����� �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � � �׀�BJ�8��0�)����w�M����� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.5902799385401805,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d20f86a532c86adaccab08c91a8b7f06",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\u001e\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\u001e\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\u001e\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\u001e\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\u001e\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c0603d413c3396a9b0728dd9b4087efcecd58ec",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\u001e\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\u001e\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\u05c0\ufffdBJ\ufffd8\ufffd\ufffd0\ufffd)\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � @���5�B��A?. P�B � �K�;�}7�7 �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � @���5�B��A?. P�B
� �K�;�}7�7 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.640863848137665,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "99d831a4a6e6f217bbc2a3f0da19da14",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?\u001b.\u0015\fP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?\u001b.\u0015\fP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?\u001b.\u0015\fP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?\u001b.\u0015\fP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?\u001b.\u0015\fP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8a76d4d849285109b2d5909b21fd4b938a7dd9dc",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?\u001b.\u0015\fP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?.P\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?\u001b.\u0015\fP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd@\ufffd\ufffd\ufffd5\ufffdB\ufffd\ufffdA?.P\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � ؈�3�W�O�=`u��&b !��XM�F� ؎��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � ؈�3�W�O�=`u��&b !��XM�F�
؎��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.648894566245786,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8aa1bcc7782476a307eb81a1b813e32d",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c662e8969f99b3f6e0bd2b100f077a7a2bd23a1e",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffd\u0608\ufffd3\ufffdW\ufffdO\ufffd=`u\ufffd\ufffd&b!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R � Q�m1{I���R<x�����dd_�D�����,N��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R � Q�m1{I���R<x�����dd_�D�����,N��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.5477267470508185,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e6eaf024a09c2b87fb03778a110361f8",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0018Q\ufffdm\u00061{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0018Q\ufffdm\u00061{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0018Q\ufffdm\u00061{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0018Q\ufffdm\u00061{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0018Q\ufffdm\u00061{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "193cbf782f1a0abc8a2bf3c99217348d91754d60",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0018Q\ufffdm\u00061{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdQ\ufffdm1{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\u0018Q\ufffdm\u00061{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR\ufffdQ\ufffdm1{I\ufffd\ufffd\ufffdR<x\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R @ A 2� �@�D�19���y���ԳH�j�ց沰
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R @ A 2� �@�D�19���y���ԳH�j�ց沰
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.611556534284861,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e2d9133ed9c0f12ea5b12b8d6a3b3b51",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000A\u000f\u000b2\ufffd\f\ufffd@\ufffdD\ufffd19\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb0\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000A\u000f\u000b2\ufffd\f\ufffd@\ufffdD\ufffd19\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb0\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000A\u000f\u000b2\ufffd\f\ufffd@\ufffdD\ufffd19\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb0\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000A\u000f\u000b2\ufffd\f\ufffd@\ufffdD\ufffd19\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb0\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000A\u000f\u000b2\ufffd\f\ufffd@\ufffdD\ufffd19\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb0\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7de8a2f2b12484925397590b6a0abe8a31508e67",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000A\u000f\u000b2\ufffd\f\ufffd@\ufffdD\ufffd19\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb0\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR@A2\ufffd\ufffd@\ufffdD\ufffd19\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb0",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000A\u000f\u000b2\ufffd\f\ufffd@\ufffdD\ufffd19\ufffd\ufffd\u0012\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb0\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR@A2\ufffd\ufffd@\ufffdD\ufffd19\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb0",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
^ $ * + , 0 1 $ U �R %� �<X�ULXK��� ������J��L�����ͅ�
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
^ $ * + , 0 1 $ U �R %� �<X�ULXK��� ������J��L�����ͅ�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 94,
"payload_entropy": 4.510273305147382,
"port_category": "registered",
"org": "SK Broadband Co Ltd",
"service": "mssql",
"app_proto": "mssql",
"asn": 9318,
"country": "KR",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 32,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868",
"event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0519"
],
"kb_rule_ids": [
"pat-0519"
],
"matched_patterns": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 9318,
"org": "SK Broadband Co Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f1f647fc2e4af66942f88c7b5a838c45",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\u0000\u0010\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\u0000\u0010\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\u0000\u0010\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\u0000\u0010\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\u0000\u0010\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3088f5f85c6888d778fcf9bfd47896559238f00f",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\u0000\u0010\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "^$*+,01$U\ufffdR%\ufffd\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519"
],
"tags_summary_labels_fr": [
"pat-0519"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\u0000\u0010\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "^$*+,01$U\ufffdR%\ufffd\ufffd<X\ufffdULXK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_flood"
]
}
|