Détails IP 1.226.4.189

Synthèse exécutive

Profil de menace

Score de risque 54/100 Moyen

Première observation 27/07/2026 03:01 UTC

Dernière observation 27/07/2026 03:03 UTC

Événements (période) 4,456

MITRE ATT&CK principal TA0007 4455 occurrences

Activité suspecte · risque 32/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Rafale d'authentification SSH · confiance 49%

Confiance 49 % — Score WAF 8

Comparaison ASN / FAI

ASN 9318 · 1.224.0.0/11 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 4,456 événements sur la période pour cette IP.

211.186.115.35 Sonde port 26/07/2026 14:42 UTC
121.125.67.137 Sonde SSH 26/07/2026 04:14 UTC
58.229.253.119 Sonde SSH 25/07/2026 02:52 UTC
222.232.176.7 Sonde SSH 24/07/2026 12:29 UTC
211.178.247.182 Sonde SSH 23/07/2026 07:15 UTC
118.216.88.229 Sonde port 23/TCP 21/07/2026 18:56 UTC
219.250.188.143 Sonde SSH 19/07/2026 20:17 UTC
58.224.62.29 Sonde SSH 17/07/2026 01:34 UTC

IPs apparentées

Même FAI SK Broadband Co Ltd — corrélation indicative.

211.186.115.35 Sonde port
121.125.67.137 Sonde SSH
58.229.253.119 Sonde SSH
222.232.176.7 Sonde SSH
211.178.247.182 Sonde SSH

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

4456 événement(s) — page 3/90

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4��H��B�棛��n6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4��H��B�棛��n6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138804, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "809239a763ae1b3e35329fe867d6b921", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffdH\ufffd\ufffd\b\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffdH\ufffd\ufffd\b\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffdH\ufffd\ufffd\b\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffdH\ufffd\ufffd\b\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffdH\ufffd\ufffd\b\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "49e315d0f06e1986b031a2c805fd4ae5932a3ab7", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffdH\ufffd\ufffd\b\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffdH\ufffd\ufffd\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffdH\ufffd\ufffd\b\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffdH\ufffd\ufffd\ufffdB\ufffd\u68db\ufffd\ufffd\ufffdn6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)l��p�F��x!�I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)l��p�F��x!�I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.49783359879664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0aa9ea34afead7a5f85f4e7ee63b0542", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\u0013\u0018\ufffd\ufffdp\ufffd\u0018F\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\u0013\u0018\ufffd\ufffdp\ufffd\u0018F\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\u0013\u0018\ufffd\ufffdp\ufffd\u0018F\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\u0013\u0018\ufffd\ufffdp\ufffd\u0018F\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\u0013\u0018\ufffd\ufffdp\ufffd\u0018F\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a3a33b12d49578e146dc96bb90bcf9ad9e8d8f30", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\u0013\u0018\ufffd\ufffdp\ufffd\u0018F\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffdp\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\u0013\u0018\ufffd\ufffdp\ufffd\u0018F\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffdp\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdx!\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R(]v(۩K�i��<#�_ek��@��n��z�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R(]v(۩K�i��<#�_ek��@��n��z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882346, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2b02a2eb0846cbb97c832124939c45c4", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000(\u000f]v(\u06e9K\ufffd\u0018i\ufffd\ufffd<#\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000(\u000f]v(\u06e9K\ufffd\u0018i\ufffd\ufffd<#\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000(\u000f]v(\u06e9K\ufffd\u0018i\ufffd\ufffd<#\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000(\u000f]v(\u06e9K\ufffd\u0018i\ufffd\ufffd<#\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000(\u000f]v(\u06e9K\ufffd\u0018i\ufffd\ufffd<#\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "655c48dfb14dc7d218e1a343b97975154649bb1d", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000(\u000f]v(\u06e9K\ufffd\u0018i\ufffd\ufffd<#\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR(]v(\u06e9K\ufffdi\ufffd\ufffd<#\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000(\u000f]v(\u06e9K\ufffd\u0018i\ufffd\ufffd<#\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR(]v(\u06e9K\ufffdi\ufffd\ufffd<#\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��.\|�B�� ΅h�AH��dt� � Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��.\|�B�� ΅h�AH��dt� � Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0db04a80b6f1b62648278faf35e9acdb", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0016.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0016.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0016.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0016.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0016.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9e22e183a8a5aac432511478ece593dabc8bbc40", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0016.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0016.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd.\|\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R\|>� t��E�~�mm&��4��eh�B��M�n8� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R\|>�t��E�~�mm&��4��eh�B��M�n8� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.611556534284862, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e6daa727a349f3f60253f466cfe18df7", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000>\u0010\ufffd\ft\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000>\u0010\ufffd\ft\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000>\u0010\ufffd\ft\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000>\u0010\ufffd\ft\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000>\u0010\ufffd\ft\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f9c401884319a3d531a9dc3a1161ad5fcab02ea9", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000>\u0010\ufffd\ft\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\|>\ufffdt\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000>\u0010\ufffd\ft\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\|>\ufffdt\ufffd\ufffdE\ufffd~\ufffdmm&\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��W[ ��C�%Mt��&R\��7K��#h�._� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��W[ ��C�%Mt��&R\��7K��#h�._� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.683417039627026, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0640fc592fdb9e03e787266f4d4c36a1", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdW[ \ufffd\ufffdC\ufffd\u0018%M\u001bt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdW[ \ufffd\ufffdC\ufffd\u0018%M\u001bt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdW[ \ufffd\ufffdC\ufffd\u0018%M\u001bt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdW[ \ufffd\ufffdC\ufffd\u0018%M\u001bt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdW[ \ufffd\ufffdC\ufffd\u0018%M\u001bt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c00eda46881417c7a5070caa284c0f9a7a68958b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdW[ \ufffd\ufffdC\ufffd\u0018%M\u001bt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffdW[ \ufffd\ufffdC\ufffd%Mt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\ufffdW[ \ufffd\ufffdC\ufffd\u0018%M\u001bt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffdW[ \ufffd\ufffdC\ufffd%Mt\ufffd\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R%�z5��F�\3�y<��J��L��ͅ� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R%�z5��F�\3�y<��J��L��ͅ� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.590279938540182, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f2c7f3d4c18af1f0a58f8e312bff0304", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000z\u00145\ufffd\ufffdF\ufffd\\3\ufffdy<\u0013\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000z\u00145\ufffd\ufffdF\ufffd\\3\ufffdy<\u0013\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000z\u00145\ufffd\ufffdF\ufffd\\3\ufffdy<\u0013\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000z\u00145\ufffd\ufffdF\ufffd\\3\ufffdy<\u0013\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000z\u00145\ufffd\ufffdF\ufffd\\3\ufffdy<\u0013\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b7b3ea01c4d5e4c84e575a36f6c0bd2a5a5a4b29", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000z\u00145\ufffd\ufffdF\ufffd\\3\ufffdy<\u0013\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR%\ufffdz5\ufffd\ufffdF\ufffd\\3\ufffdy<\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000z\u00145\ufffd\ufffdF\ufffd\\3\ufffdy<\u0013\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR%\ufffdz5\ufffd\ufffdF\ufffd\\3\ufffdy<\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R'�_��t��A�\S��,2��cþA�F-�4j� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R'�_��t��A�\S��,2��cþA�F-�4j� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392984, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "45b7c7ac545557e8d431afe17e953b1a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,\u001d2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,\u001d2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,\u001d2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,\u001d2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,\u001d2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7899a9d7a459d3b50a089d9e35fc752b354ecbe1", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,\u001d2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR'\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,\u001d2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR'\ufffd_\ufffd\ufffdt\ufffd\ufffdA\ufffd\\S\ufffd\ufffd\ufffd,2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��# ��L��D�%�7!��XM�F� ؎�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��# ��L��D�%�7!��XM�F� ؎�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.648894566245786, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6dfe38d6a6ee7a9ff1e9301864a8da27", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd#\u0007\t\ufffd\ufffdL\ufffd\ufffdD\ufffd\u0007%\ufffd7\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd#\u0007\t\ufffd\ufffdL\ufffd\ufffdD\ufffd\u0007%\ufffd7\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd#\u0007\t\ufffd\ufffdL\ufffd\ufffdD\ufffd\u0007%\ufffd7\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd#\u0007\t\ufffd\ufffdL\ufffd\ufffdD\ufffd\u0007%\ufffd7\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd#\u0007\t\ufffd\ufffdL\ufffd\ufffdD\ufffd\u0007%\ufffd7\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1e50274ee1f50a703b542345d52f9cee8b226ae1", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd#\u0007\t\ufffd\ufffdL\ufffd\ufffdD\ufffd\u0007%\ufffd7\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd#\t\ufffd\ufffdL\ufffd\ufffdD\ufffd%\ufffd7!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd#\u0007\t\ufffd\ufffdL\ufffd\ufffdD\ufffd\u0007%\ufffd7\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd#\t\ufffd\ufffdL\ufffd\ufffdD\ufffd%\ufffd7!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"<�s��Ί O��#8�Dq��x�L��,Pf�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"<�s��ΊO��#8�Dq��x�L��,Pf�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882345, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "360f61744e8606a07a9c9f721c43dba3", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffds\ufffd\ufffd\u038a\u000bO\ufffd\ufffd\ufffd\ufffd\u0005#8\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffds\ufffd\ufffd\u038a\u000bO\ufffd\ufffd\ufffd\ufffd\u0005#8\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffds\ufffd\ufffd\u038a\u000bO\ufffd\ufffd\ufffd\ufffd\u0005#8\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffds\ufffd\ufffd\u038a\u000bO\ufffd\ufffd\ufffd\ufffd\u0005#8\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffds\ufffd\ufffd\u038a\u000bO\ufffd\ufffd\ufffd\ufffd\u0005#8\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3a0d84b4c85222ee84181557f81cb30c33b1915d", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffds\ufffd\ufffd\u038a\u000bO\ufffd\ufffd\ufffd\ufffd\u0005#8\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffds\ufffd\ufffd\u038aO\ufffd\ufffd\ufffd\ufffd#8\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffds\ufffd\ufffd\u038a\u000bO\ufffd\ufffd\ufffd\ufffd\u0005#8\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffds\ufffd\ufffd\u038aO\ufffd\ufffd\ufffd\ufffd#8\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R@r�f�T/J��q�M�y��ԳH�j�ց沮 Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R@r�f�T/J��q�M�y��ԳH�j�ց沮 Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ec529c99424bcca32fffc15dff7bb5de", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000r\ufffd\u0014f\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\u0017\u001c\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cae\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000r\ufffd\u0014f\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\u0017\u001c\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cae\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000r\ufffd\u0014f\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\u0017\u001c\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cae\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000r\ufffd\u0014f\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\u0017\u001c\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cae\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000r\ufffd\u0014f\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\u0017\u001c\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cae\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b3466e0b175c18bc383e0175d0de75fae7afd45", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000r\ufffd\u0014f\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\u0017\u001c\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cae\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR@r\ufffdf\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cae", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000r\ufffd\u0014f\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\u0017\u001c\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cae\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR@r\ufffdf\ufffdT\/J\ufffd\ufffd\ufffdq\ufffdM\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cae", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��e�`8I��O+��dd_�D��,N�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��e�`8I��O+��dd_�D��,N�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "895979a500b9048da7d9d8e9d07f9040", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "852fc568b648483ab3b719b82867c5553fb77ee7", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffde\ufffd`8I\ufffd\ufffdO\ue956+\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��g��rۇH�˭��ı�1� �wH��9�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��g��rۇH�˭��ı�1� �wH��9�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903621, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "590d84ef860803c7575047ed4efddf0a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\u0005\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\u0005\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\u0005\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\u0005\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\u0005\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a527f80c1dcffe821e078bc5fb68ef3b97e532c", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\u0005\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\u0005\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdg\ufffd\ufffdr\u06c7H\ufffd\u02ed\ufffd\ufffd\ufffd\u0131\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RPlP��0!K��{�S�W��WIK��x��B� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RPlP��0!K��{�S�W��WIK��x��B� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903621, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2c4d317d2557eee8bcf198c476f40178", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0015lP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\u0014\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0015lP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\u0014\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0015lP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\u0014\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0015lP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\u0014\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0015lP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\u0014\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "50ab15149a9882053a93d985aa31ecf71ab5d744", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0015lP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\u0014\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRPlP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u0015lP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\u0014\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRPlP\ufffd\ufffd0!K\ufffd\ufffd{\ufffdS\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�й%��G�=�ޚ��_L歽rvA�U�X�m� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�й%��G�=�ޚ��_L歽rvA�U�X�m� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e2edec0dce62bb6db6955195ea585004", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd\u0439%\ufffd\u0003\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd\u0439%\ufffd\u0003\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd\u0439%\ufffd\u0003\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd\u0439%\ufffd\u0003\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd\u0439%\ufffd\u0003\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "21d7f1da2086eeddc4fae2c5b0cb8701db976e6c", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd\u0439%\ufffd\u0003\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\u0439%\ufffd\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000\ufffd\u0439%\ufffd\u0003\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\u0439%\ufffd\ufffdG\ufffd=\ufffd\u079a\ufffd\ufffd_L\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R8��X�F��,�:��N��(�v�LN�&�(�/6� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R8��X�F��,�:��N��(�v�LN�&�(�/6� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138804, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c4deb09d8404f4296258be611461c9f3", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\u0001\ufffdX\u001e\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\u0001\ufffdX\u001e\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\u0001\ufffdX\u001e\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\u0001\ufffdX\u001e\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\u0001\ufffdX\u001e\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "02abfef696833be069d9651c098b8b352b7206b5", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\u0001\ufffdX\u001e\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\ufffd\ufffdX\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\ufffd\u0001\ufffdX\u001e\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\ufffd\ufffdX\ufffdF\ufffd\ufffd,\ufffd:\ufffd\ufffdN\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4�H �Ǫ�G�r��5���kepqC�NS,�K� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4�H �Ǫ�G�r��5���kepqC�NS,�K� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.540386790286002, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9525d0576ad12ce2ce592922e359ea70", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "05b2a01966ddef205d1771571900adbe643a766c", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffdH\n\ufffd\u01ea\ufffdG\ufffdr\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"��N��[�\|�^��@q��G��X�vni� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"��N��[�\|�^��@q��G��X�vni� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882345, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eb448fa5df0eeebbe28e2af36e06b4f0", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0015\u0011N\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0015\u0011N\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0015\u0011N\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0015\u0011N\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0015\u0011N\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4be8f5585df5064110311049debb93debb29ae89", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0015\u0011N\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0015\u0011N\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffd[\ufffd\|\ufffd^\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��0��veD��: qH0��w�M�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��0��veD��: qH0��w�M�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.60352581617674, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2b8bab2cb90c26cc723427ee592ce909", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "83cf914bf476726283e76f59e7f016e75f528a46", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd0\ufffd\ufffdveD\ufffd\ufffd\ufffd:\rqH0\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&T��~MrA�J�97y[m�h�D�E�LK$�ˮ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&T��~MrA�J�97y[m�h�D�E�LK$�ˮ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.574218502323937, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "11e1d9659cfdaffced0703588a0e2f7a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffd~MrA\ufffd\u001fJ\ufffd97y[m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ee\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffd~MrA\ufffd\u001fJ\ufffd97y[m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ee\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffd~MrA\ufffd\u001fJ\ufffd97y[m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ee\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffd~MrA\ufffd\u001fJ\ufffd97y[m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ee\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffd~MrA\ufffd\u001fJ\ufffd97y[m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ee\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6375c6df395a977c551f1eae365bdb1bef0b9537", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffd~MrA\ufffd\u001fJ\ufffd97y[m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ee\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd\ufffd\ufffd~MrA\ufffdJ\ufffd97y[m\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02ee", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffd\ufffd~MrA\ufffd\u001fJ\ufffd97y[m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ee\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd\ufffd\ufffd~MrA\ufffdJ\ufffd97y[m\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02ee", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��[��IkF�� U��B!1I�� O<�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��[��IkF��U��B!1I�� O<�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.598310656648303, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7f49f8b310cde6dc16c2ffeec665a7ca", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25c2d950b15b22ef56f6385bec7644277ff3a612", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd[\ufffd\ufffdIkF\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�Rd��8��=G� �f��8�G4��D~?K�KiSY?�[� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�Rd��8��=G��f��8�G4��D~?K�KiSY?�[� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903622, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9b6193b62e00d29ba3246743a7a9262", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\u000b\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\u000b\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\u000b\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\u000b\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\u000b\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ceaa26e35e0117367a55c64ca10ee6c243bfcbb8", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\u000b\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\u000b\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\ufffd\ufffd8\ufffd\ufffd=G\ufffd\ufffdf\ufffd\ufffd8\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��#��D��!��P�B � �K�;�}7�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��#��D��!��P�B ��K�;�}7�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138807, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d98714ede2280f33e629e7e845e6c303", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffd\u0001P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffd\u0001P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffd\u0001P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffd\u0001P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffd\u0001P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "92ace412b269ce06d7277a13d5ff5e4f8bb67d8b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffd\u0001P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffd\u0001P\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd!\ufffd\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)l��ՙG�=f�&� MI� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)l��ՙG�=f�&� MI� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138804, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ae313483075cdc44ad63fdf67f32beb6", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0013\ufffd\u001b\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0013\ufffd\u001b\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0013\ufffd\u001b\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0013\ufffd\u001b\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0013\ufffd\u001b\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c3452432efb21ce657e56ce5edc8e1c0a7b32159", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0013\ufffd\u001b\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffd\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0013\ufffd\u001b\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffd\ufffd\u0559G\ufffd=f\ufffd&\ufffd MI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4�� B�񵬋}D�6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4��B�񵬋}D�6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.540386790286002, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "af58b0c77fb116832e072618d2541429", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u0012\u000b\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u0012\u000b\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u0012\u000b\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u0012\u000b\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u0012\u000b\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "babcfded3f237461063b2d15e281ecf08a4b7600", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u0012\u000b\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u0012\u000b\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ud996\udf0b}D\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��]El�N��Iy�ekϡL�b�E� K�� ϭ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��]El�N��Iy�ekϡL�b�E� K�� ϭ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5902799385401805, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "96f16377dd19a49dc234232ece3ac5be", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0005\ufffd]El\u0005\ufffdN\ufffd\ufffdIy\ufffdek\u001c\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ed\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0005\ufffd]El\u0005\ufffdN\ufffd\ufffdIy\ufffdek\u001c\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ed\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0005\ufffd]El\u0005\ufffdN\ufffd\ufffdIy\ufffdek\u001c\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ed\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0005\ufffd]El\u0005\ufffdN\ufffd\ufffdIy\ufffdek\u001c\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ed\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0005\ufffd]El\u0005\ufffdN\ufffd\ufffdIy\ufffdek\u001c\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ed\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47c98d061e19b7293472642d8af1c914073e0533", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0005\ufffd]El\u0005\ufffdN\ufffd\ufffdIy\ufffdek\u001c\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ed\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd]El\ufffdN\ufffd\ufffdIy\ufffdek\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03ed", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0005\ufffd]El\u0005\ufffdN\ufffd\ufffdIy\ufffdek\u001c\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ed\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd]El\ufffdN\ufffd\ufffdIy\ufffdek\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03ed", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��+/�B�XLĽ�㈿.�C��E��2��F�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��+/�B�XLĽ�㈿.�C��E��2��F�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "701cba68a8637b6cc002d987dabf3179", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd\u0007\u0014+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd\u0007\u0014+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd\u0007\u0014+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd\u0007\u0014+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd\u0007\u0014+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f10ecf4f4dc08e7e4608719c285368d745ca1c59", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd\u0007\u0014+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffd\ufffd+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd\u0007\u0014+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffd\ufffd+\/\ufffdB\ufffdXL\u013d\ufffd\u323f.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R\|~�c~:F��˺��4��eh�B��M�n8� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R\|~�c~:F��˺��4��eh�B��M�n8� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.544795778528621, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f4c0a219ffee3b0259a05a07971202ff", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\u0006~\ufffdc~\u0000:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\u0006~\ufffdc~\u0000:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\u0006~\ufffdc~\u0000:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\u0006~\ufffdc~\u0000:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\u0006~\ufffdc~\u0000:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d2f87740f352468237cc94891d8a49e049056851", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\u0006~\ufffdc~\u0000:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\|~\ufffdc~:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\u0006~\ufffdc~\u0000:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\|~\ufffdc~:F\ufffd\ufffd\u02fa\ufffd\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R6��E��/��_ek��@��n��z�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R6��E��/��_ek��@��n��z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903623, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9e82d9a28466d7e534fa7f7d3010d739", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u00006\ufffd\ufffd\ufffd\ufffd\u001cE\ufffd\ufffd\ufffd\b\/\u001e\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u00006\ufffd\ufffd\ufffd\ufffd\u001cE\ufffd\ufffd\ufffd\b\/\u001e\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u00006\ufffd\ufffd\ufffd\ufffd\u001cE\ufffd\ufffd\ufffd\b\/\u001e\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u00006\ufffd\ufffd\ufffd\ufffd\u001cE\ufffd\ufffd\ufffd\b\/\u001e\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u00006\ufffd\ufffd\ufffd\ufffd\u001cE\ufffd\ufffd\ufffd\b\/\u001e\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ba540217013d0c780a83b6ace49197888d2eac05", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u00006\ufffd\ufffd\ufffd\ufffd\u001cE\ufffd\ufffd\ufffd\b\/\u001e\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR6\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\/\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u00006\ufffd\ufffd\ufffd\ufffd\u001cE\ufffd\ufffd\ufffd\b\/\u001e\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR6\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\/\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�W��~��H�[XF�:΅h�AH��dt� � Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�W��~��H�[XF�:΅h�AH��dt� � Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5902799385401805, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d822acd24e1c19e83d886148e221406a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000W\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd\u0019:\u0005\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000W\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd\u0019:\u0005\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000W\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd\u0019:\u0005\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000W\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd\u0019:\u0005\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000W\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd\u0019:\u0005\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "518a9fa65cbfb3251ae456c445b289bb53b9e917", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000W\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd\u0019:\u0005\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdW\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd:\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000W\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd\u0019:\u0005\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdW\ufffd\ufffd\ufffd~\ufffd\ufffdH\ufffd[XF\ufffd:\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��\5�a&}J�S�HA;�e�&R\��7K��#h�._� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��\5�a&}J�S�HA;�e�&R\��7K��#h�._� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "df9a74b40f8eb6d64ff1530152844df9", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "77bc597a19e72ac6dc1d0d05fac3b383d6c1a8d9", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\\5\ufffda&}J\ufffdS\ufffdHA;\ufffde\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R%�lT��H�&Q&�- v��J��L��ͅ� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R%�lT��H�&Q&�- v��J��L��ͅ� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137665, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "54b8558fd7ac8f5977dd60e0b8bb561d", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0019l\u001cT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0019l\u001cT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0019l\u001cT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0019l\u001cT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0019l\u001cT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9a74b90ac2aa31ca45cccb5b190cd091ddf8bc3b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0019l\u001cT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR%\ufffdlT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0019l\u001cT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR%\ufffdlT\ufffd\ufffd\ufffdH\ufffd&Q&\ufffd-\rv\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R'�� oB��,��2��cþA�F-�4j� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R'�� oB��,��2��cþA�F-�4j� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882346, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "65cbec55b7ce845480a832cfc2624a8b", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\u0011\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\u0011\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\u0011\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\u0011\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\u0011\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eb27fd6409e3e5b3c76187fd88c102bcac2ea807", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\u0011\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR'\ufffd\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffd\u0011\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR'\ufffd\ufffd \ufffd\ufffdoB\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��Jy�-I�W�~5I.!��XM�F� ؎�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��Jy�-I�W�~5I.!��XM�F� ؎�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.560857214744864, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5fc520d9045b1a671ddc063255952514", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0018\ufffdJy\ufffd\u0015-I\ufffdW\ufffd~5\u0000I.\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0018\ufffdJy\ufffd\u0015-I\ufffdW\ufffd~5\u0000I.\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0018\ufffdJy\ufffd\u0015-I\ufffdW\ufffd~5\u0000I.\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0018\ufffdJy\ufffd\u0015-I\ufffdW\ufffd~5\u0000I.\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0018\ufffdJy\ufffd\u0015-I\ufffdW\ufffd~5\u0000I.\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "269081ab259ea1dc6d0f06dbe8452b06f3d39105", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0018\ufffdJy\ufffd\u0015-I\ufffdW\ufffd~5\u0000I.\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdJy\ufffd-I\ufffdW\ufffd~5I.!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\u0018\ufffdJy\ufffd\u0015-I\ufffdW\ufffd~5\u0000I.\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdJy\ufffd-I\ufffdW\ufffd~5I.!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"<�kw@�7@�m�B��Dq��x�L��,Pf�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"<�kw@�7@�m�B��Dq��x�L��,Pf�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138804, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "81369d2d039493e26ad682e1197b25dc", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0001\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\u001b\ufffd\u0003Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0001\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\u001b\ufffd\u0003Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0001\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\u001b\ufffd\u0003Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0001\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\u001b\ufffd\u0003Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0001\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\u001b\ufffd\u0003Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7ccd432fa820f9f4469c7fb059a749128653573f", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0001\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\u001b\ufffd\u0003Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0001\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\u001b\ufffd\u0003Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffdkw@\ufffd7@\ufffdm\ufffdB\ufffd\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4KNlǺ[K�w��c ��kepqC�NS,�K� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4KNlǺ[K�w��c��kepqC�NS,�K� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.519110194541321, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f4d2310072dd72a1afeef13d2bfacaa5", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000KNl\u01fa[K\ufffdw\ufffd\u0019\ufffdc\u000b\u001e\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000KNl\u01fa[K\ufffdw\ufffd\u0019\ufffdc\u000b\u001e\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000KNl\u01fa[K\ufffdw\ufffd\u0019\ufffdc\u000b\u001e\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000KNl\u01fa[K\ufffdw\ufffd\u0019\ufffdc\u000b\u001e\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000KNl\u01fa[K\ufffdw\ufffd\u0019\ufffdc\u000b\u001e\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a0237ca17ed09b2d6d81a4a2807c2ff9cb3f3ce1", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000KNl\u01fa[K\ufffdw\ufffd\u0019\ufffdc\u000b\u001e\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4KNl\u01fa[K\ufffdw\ufffd\ufffdc\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000KNl\u01fa[K\ufffdw\ufffd\u0019\ufffdc\u000b\u001e\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4KNl\u01fa[K\ufffdw\ufffd\ufffdc\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R8�/W�@)�J�zS�0f��(�v�LN�&�(�/6� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R8�/W�@)�J�zS�0f��(�v�LN�&�(�/6� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cd243274792e04640f059d78f6006781", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\/W\ufffd@)\ufffdJ\ufffdz\u0013S\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\/W\ufffd@)\ufffdJ\ufffdz\u0013S\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\/W\ufffd@)\ufffdJ\ufffdz\u0013S\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\/W\ufffd@)\ufffdJ\ufffdz\u0013S\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\/W\ufffd@)\ufffdJ\ufffdz\u0013S\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6574e9f0661bf13bab05e53a6c77f728af9e9ee0", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\/W\ufffd@)\ufffdJ\ufffdz\u0013S\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\/W\ufffd@)\ufffdJ\ufffdzS\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\/W\ufffd@)\ufffdJ\ufffdz\u0013S\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\/W\ufffd@)\ufffdJ\ufffdzS\ufffd0f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��)$�C�J��.�-y ��1� �wH��9�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��)$�C�J��.�-y ��1� �wH��9�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.60352581617674, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a8a01d02cb3abf7485412304c23199a8", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9423cccc881fcf7a9c696a6121b226fbf598af7b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd)$\ufffdC\ufffdJ\ufffd\ufffd.\ufffd-y\t\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�Rh�_fu^�G�'L��L歽rvA�U�X�m� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�Rh�_fu^�G�'L��L歽rvA�U�X�m� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.552826496636742, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5515e1106fdfb2d5070c02ef5f5be221", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000h\ufffd_fu^\ufffdG\ufffd'L\u0000\ufffd\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000h\ufffd_fu^\ufffdG\ufffd'L\u0000\ufffd\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000h\ufffd_fu^\ufffdG\ufffd'L\u0000\ufffd\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000h\ufffd_fu^\ufffdG\ufffd'L\u0000\ufffd\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000h\ufffd_fu^\ufffdG\ufffd'L\u0000\ufffd\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f12ffc363d8cb66ba2b54d93d553b09909fb0b0", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000h\ufffd_fu^\ufffdG\ufffd'L\u0000\ufffd\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRh\ufffd_fu^\ufffdG\ufffd'L\ufffd\ufffd\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000h\ufffd_fu^\ufffdG\ufffd'L\u0000\ufffd\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRh\ufffd_fu^\ufffdG\ufffd'L\ufffd\ufffd\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R@2އ U�N��?��y��ԳH�j�ց沯 Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R@2އU�N��?��y��ԳH�j�ց沯 Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ba8dc7473d21a08b788a136112c93d36", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u00002\u0787\u0015\u000bU\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\u000f\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6caf\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u00002\u0787\u0015\u000bU\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\u000f\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6caf\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u00002\u0787\u0015\u000bU\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\u000f\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6caf\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u00002\u0787\u0015\u000bU\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\u000f\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6caf\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u00002\u0787\u0015\u000bU\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\u000f\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6caf\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9ff54fc3774f2d6aa04b1bae7e281283a04fe60a", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u00002\u0787\u0015\u000bU\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\u000f\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6caf\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR@2\u0787U\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6caf", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u00002\u0787\u0015\u000bU\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\u000f\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6caf\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR@2\u0787U\ufffdN\ufffd\ufffd?\u0086\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6caf", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"�JVN\|H�`�[��@q��G��X�vni� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"�JVN\|H�`�[��@q��G��X�vni� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.704693635371706, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a6a464d059795da568b80f55f6e5e31c", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000J\u0013V\u0018N\u0010\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000J\u0013V\u0018N\u0010\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000J\u0013V\u0018N\u0010\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000J\u0013V\u0018N\u0010\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000J\u0013V\u0018N\u0010\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e27eac2922776b76143c91237db6ee0c9f02e3d1", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000J\u0013V\u0018N\u0010\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"\ufffdJVN\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000J\u0013V\u0018N\u0010\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"\ufffdJVN\|H\ufffd`\ue45c\ufffd[\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:00 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RPFx��VG��K,�YW��WIK��x��B� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RPFx��VG��K,�YW��WIK��x��B� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903621, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "94f1a4d437465621fc5eafa3646e8be1", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000Fx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffd\u0011YW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000Fx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffd\u0011YW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000Fx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffd\u0011YW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000Fx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffd\u0011YW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000Fx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffd\u0011YW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "aa69c85cb88fb69641092268825d713ed889c5f1", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000Fx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffd\u0011YW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRPFx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffdYW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000Fx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffd\u0011YW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRPFx\ufffd\ufffd\ufffd\ufffdVG\ufffd\ufffd\ufffdK,\ufffdYW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��F~��H��G�i��B!1I�� O<�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��F~��H��G�i��B!1I�� O<�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1b2f989ff8aeb7cc36154e6c8eabec4c", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\u0014\ufffdG\u0016\ufffdi\u0005\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\u0014\ufffdG\u0016\ufffdi\u0005\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\u0014\ufffdG\u0016\ufffdi\u0005\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\u0014\ufffdG\u0016\ufffdi\u0005\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\u0014\ufffdG\u0016\ufffdi\u0005\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ab54bc9792c1783c1e9385cc85b9c1b5b7d210e", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\u0014\ufffdG\u0016\ufffdi\u0005\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\ufffdG\ufffdi\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\u0014\ufffdG\u0016\ufffdi\u0005\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd\ufffdF~\ufffd\ufffdH\ufffd\ufffdG\ufffdi\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RdO�j��>pK�V��f��G4��D~?K�KiSY?�[� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RdO�j��>pK�V��f��G4��D~?K�KiSY?�[� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569003342795501, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "441bf17086169e131c5f53c751e09bcd", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000O\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000O\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000O\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000O\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000O\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fe8f7ea81cfbb3fb50599bf6a5ecba568d34a9b0", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000O\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRdO\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000O\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRdO\ufffdj\ufffd\ufffd>pK\ufffdV\ufffd\ufffd\ufffdf\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&TQ� ��?G�U��I(m�h�D�E�LK$�ˬ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&TQ� ��?G�U��I(m�h�D�E�LK$�ˬ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.560972624687378, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dfb94febad8775c958ff8bd42f87def2", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000Q\u0018\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ec\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000Q\u0018\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ec\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000Q\u0018\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ec\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000Q\u0018\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ec\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000Q\u0018\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ec\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "97f2734f358ea9388022d0e9825856a14ca7ce5f", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000Q\u0018\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ec\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&TQ\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02ec", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000Q\u0018\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02ec\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&TQ\ufffd \ufffd\ufffd?G\ufffdU\ufffd\ufffd\ufffd\ufffdI(m\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02ec", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��({�ʋ�D�FR�7��.�C��E��2��F�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��({�ʋ�D�FR�7��.�C��E��2��F�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.612247295628166, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9e5f038a49e4f8565ee63daee27eb9a5", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\u0015\u0001\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\u0015\u0001\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\u0015\u0001\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\u0015\u0001\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\u0015\u0001\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7847f2cfbc23990145ad0662dc06c2425d8ce90", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\u0015\u0001\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\u0015\u0001\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffd({\ufffd\u028b\ufffdD\ufffdFR\ufffd7\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�0��mA��+1�#�rP�B � �K�;�}7�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�0��mA��+1�#�rP�B ��K�;�}7�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569003342795501, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f471ef8afb7f111c83c72c057767fff7", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00000\ufffd\u000f\u0012\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00000\ufffd\u000f\u0012\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00000\ufffd\u000f\u0012\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00000\ufffd\u000f\u0012\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00000\ufffd\u000f\u0012\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b37341d385d19eebf70dad7d8d8a7f75900c038", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00000\ufffd\u000f\u0012\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd0\ufffd\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00000\ufffd\u000f\u0012\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd0\ufffd\ufffd\ufffdmA\ufffd\ufffd+1\ufffd#\ufffdrP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�o�l_ J��!Z3�`ϡL�b�E� K�� ϫ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�o�l_ J��!Z3�`ϡL�b�E� K�� ϫ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.555757465158941, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "95feb74fc9b9ef2b1772c493137dd453", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0004o\ufffdl_\r\u001fJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03eb\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0004o\ufffdl_\r\u001fJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03eb\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0004o\ufffdl_\r\u001fJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03eb\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0004o\ufffdl_\r\u001fJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03eb\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0004o\ufffdl_\r\u001fJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03eb\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f14c70496b1a8d1fb7ee31e189ddcd32a921ddb1", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0004o\ufffdl_\r\u001fJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03eb\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdo\ufffdl_\rJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03eb", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\u0004o\ufffdl_\r\u001fJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03eb\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdo\ufffdl_\rJ\ufffd\ufffd\ufffd!Z3\ufffd`\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03eb", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)l^_>��B�`��X��I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)l^_>��B�`��X��I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.548417508394124, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fc6c7ecad4eec11e0110708ebf207753", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000^_>\ufffd\ufffd\u001e\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000^_>\ufffd\ufffd\u001e\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000^_>\ufffd\ufffd\u001e\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000^_>\ufffd\ufffd\u001e\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000^_>\ufffd\ufffd\u001e\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "02100e5694b33745afd36ea0bfe2ac8dd571f322", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000^_>\ufffd\ufffd\u001e\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)l^_>\ufffd\ufffd\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000^_>\ufffd\ufffd\u001e\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)l^_>\ufffd\ufffd\ufffdB\ufffd`\ufffd\ufffd\ufffdX\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:59 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4��߼:��G�?%.��8�6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4��߼:��G�?%.��8�6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138804, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7d1070d7112cd0777d243cda3ba2e842", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9717707c57031583ded6065d27f71757f7859d96", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\u07fc:\ufffd\ufffdG\ufffd?%.\ufffd\ufffd8\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }

1.226.4.189

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence