Détails IP 1.226.4.189

Synthèse exécutive

Profil de menace

Score de risque 54/100 Moyen

Première observation 27/07/2026 03:01 UTC

Dernière observation 27/07/2026 03:03 UTC

Événements (période) 4,456

MITRE ATT&CK principal TA0007 4455 occurrences

Activité suspecte · risque 32/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Rafale d'authentification SSH · confiance 49%

Confiance 49 % — Score WAF 8

Comparaison ASN / FAI

ASN 9318 · 1.224.0.0/11 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 4,456 événements sur la période pour cette IP.

211.186.115.35 Sonde port 26/07/2026 14:42 UTC
121.125.67.137 Sonde SSH 26/07/2026 04:14 UTC
58.229.253.119 Sonde SSH 25/07/2026 02:52 UTC
222.232.176.7 Sonde SSH 24/07/2026 12:29 UTC
211.178.247.182 Sonde SSH 23/07/2026 07:15 UTC
118.216.88.229 Sonde port 23/TCP 21/07/2026 18:56 UTC
219.250.188.143 Sonde SSH 19/07/2026 20:17 UTC
58.224.62.29 Sonde SSH 17/07/2026 01:34 UTC

IPs apparentées

Même FAI SK Broadband Co Ltd — corrélation indicative.

211.186.115.35 Sonde port
121.125.67.137 Sonde SSH
58.229.253.119 Sonde SSH
222.232.176.7 Sonde SSH
211.178.247.182 Sonde SSH

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

4456 événement(s) — page 7/90

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R\|��]��D��0�wa�4��eh�B��M�n8� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R\|��]��D��0�wa�4��eh�B��M�n8� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882345, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e8a5eaf2290ccb47cf07849908ae62c9", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\u0011\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffd\u0017wa\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\u0011\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffd\u0017wa\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\u0011\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffd\u0017wa\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\u0011\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffd\u0017wa\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\u0011\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffd\u0017wa\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c46071bff7c7ea853c5ff30fd82c0f6fd0bdbd6", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\u0011\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffd\u0017wa\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\|\ufffd\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffdwa\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\u0011\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffd\u0017wa\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\|\ufffd\ufffd]\ufffd\ufffdD\ufffd\ufffd0\ufffdwa\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �;m�y��G�_^��s��B!1I�� O<�� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R �;m�y��G�_^��s��B!1I�� O<�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "13726e7e26a4d45bcde11a4fad175325", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000;m\ufffdy\ufffd\u0013\ufffdG\ufffd_^\ufffd\ufffds\u0018\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000;m\ufffdy\ufffd\u0013\ufffdG\ufffd_^\ufffd\ufffds\u0018\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000;m\ufffdy\ufffd\u0013\ufffdG\ufffd_^\ufffd\ufffds\u0018\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000;m\ufffdy\ufffd\u0013\ufffdG\ufffd_^\ufffd\ufffds\u0018\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000;m\ufffdy\ufffd\u0013\ufffdG\ufffd_^\ufffd\ufffds\u0018\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ed51928b6e0d675a4932bef664d6a2f40a3d6124", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000;m\ufffdy\ufffd\u0013\ufffdG\ufffd_^\ufffd\ufffds\u0018\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd;m\ufffdy\ufffd\ufffdG\ufffd_^\ufffd\ufffds\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000;m\ufffdy\ufffd\u0013\ufffdG\ufffd_^\ufffd\ufffds\u0018\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd;m\ufffdy\ufffd\ufffdG\ufffd_^\ufffd\ufffds\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&T�^��O��lxn��m�h�D�E�LK$�˨ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&T�^��O��lxn��m�h�D�E�LK$�˨ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.539696028942697, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "623383a2176b891f48412012574014aa", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd^\u0002\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e8\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd^\u0002\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e8\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd^\u0002\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e8\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd^\u0002\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e8\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd^\u0002\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e8\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e3d0054a1d5e4940bed044184621f4df0f08bbaa", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd^\u0002\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e8\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd^\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02e8", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd^\u0002\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e8\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd^\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffdlxn\ufffd\ufffd\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02e8", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�3�r�A�C��x_�{n�P�B � �K�;�}7�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�3�r�A�C��x_�{n�P�B ��K�;�}7�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882346, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "47e57488f121264af26828817e3956fb", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00003\ufffdr\ufffd\u001aA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00003\ufffdr\ufffd\u001aA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00003\ufffdr\ufffd\u001aA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00003\ufffdr\ufffd\u001aA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00003\ufffdr\ufffd\u001aA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cdb75fdb557f5311f9f2b88e2e347d16e5174711", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00003\ufffdr\ufffd\u001aA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd3\ufffdr\ufffdA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u00003\ufffdr\ufffd\u001aA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd3\ufffdr\ufffdA\ufffdC\ufffd\ufffdx_\ufffd{n\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��R�=��G��ycR��bϡL�b�E� K�� ϧ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��R�=��G��ycR��bϡL�b�E� K�� ϧ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5690033427955, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "09e59d7e549913a6a4671011969d3fdc", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e7\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e7\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e7\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e7\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e7\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "138423d8aa6f4619a590bf61057a3618815a8db6", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e7\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03e7", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e7\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffdR\ufffd=\ufffd\ufffdG\ufffd\ufffdycR\ufffd\ufffdb\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03e7", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �cS���J�� 2��.�C��E��2��F�� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R �cS���J��2��.�C��E��2��F�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903621, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eefb0a15fa4c65728d92deeaca781d30", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000cS\ufffd\ufffd\ufffd\u0017J\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000cS\ufffd\ufffd\ufffd\u0017J\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000cS\ufffd\ufffd\ufffd\u0017J\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000cS\ufffd\ufffd\ufffd\u0017J\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000cS\ufffd\ufffd\ufffd\u0017J\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6d6e50f02f5a6e6d62200edc7d68128c6ad3cea4", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000cS\ufffd\ufffd\ufffd\u0017J\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR \ufffdcS\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000cS\ufffd\ufffd\ufffd\u0017J\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR \ufffdcS\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�Rc�X�f�{E�:�d��_ek��@��n��z�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�Rc�X�f�{E�:�d��_ek��@��n��z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.6834170396270265, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "481d9e11a001b7d4ccea62b95f12d978", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000c\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\u0018\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000c\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\u0018\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000c\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\u0018\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000c\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\u0018\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000c\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\u0018\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "db7f9ce0abca3940982a08f1b1bc8a895515ceec", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000c\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\u0018\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRc\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000c\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\u0018\ufffd\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRc\ufffdX\ufffdf\ufffd{E\ufffd:\ufffdd\ufffd\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:56 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)lZ�+Q63A�s#M�� I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)lZ�+Q63A�s#M��I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.496987009924585, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9ef59a686283c300234a4e8602fbabbb", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000Z\ufffd+Q6\u00013A\ufffds#M\ufffd\u001a\ufffd\fI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000Z\ufffd+Q6\u00013A\ufffds#M\ufffd\u001a\ufffd\fI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000Z\ufffd+Q6\u00013A\ufffds#M\ufffd\u001a\ufffd\fI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000Z\ufffd+Q6\u00013A\ufffds#M\ufffd\u001a\ufffd\fI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000Z\ufffd+Q6\u00013A\ufffds#M\ufffd\u001a\ufffd\fI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0c1fb0e404177769df43d7af09e7e9a415f366a2", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000Z\ufffd+Q6\u00013A\ufffds#M\ufffd\u001a\ufffd\fI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)lZ\ufffd+Q63A\ufffds#M\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000Z\ufffd+Q6\u00013A\ufffds#M\ufffd\u001a\ufffd\fI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)lZ\ufffd+Q63A\ufffds#M\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R!�� DqF��+u�_ek��@��n��z�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R!�� DqF��+u�_ek��@��n��z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.612247295628167, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "82244ad113fa547faf39808b9e8040e6", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\u0019\ufffd+u\u0001\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\u0019\ufffd+u\u0001\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\u0019\ufffd+u\u0001\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\u0019\ufffd+u\u0001\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\u0019\ufffd+u\u0001\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a82f55f094c69d435245aaab287824bd5f5701f8", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\u0019\ufffd+u\u0001\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\ufffd+u\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\u0019\ufffd+u\u0001\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR!\ufffd\ufffd\ufffd DqF\ufffd\ufffd\ufffd+u\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RdW��ޝ�G��'��G4��D~?K�KiSY?�[� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RdW��ޝ�G��'��G4��D~?K�KiSY?�[� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392985, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05709270c7e6de071c5f0129b7878a21", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000W\u0014\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000W\u0014\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000W\u0014\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000W\u0014\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000W\u0014\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "76a3f9d7d5c2dc24725a15573e32b1c8a0984531", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000W\u0014\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRdW\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000W\u0014\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRdW\ufffd\ufffd\u079d\ufffdG\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffdG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��me6�3�D��0!�P�B � �K�;�}7�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��me6�3�D��0!�P�B ��K�;�}7�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.590970699883487, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d42887e760d99a23bbd1cf071485e645", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\u0001\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\u0001\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\u0001\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\u0001\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\u0001\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2078476eafe48a883e3b78ba312656a69741f77a", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\u0001\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\u0001\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdme6\ufffd3\ufffdD\ufffd\ufffd\ufffd0!\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��#�\|��I��6��.�C��E��2��F�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��#�\|��I��6��.�C��E��2��F�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.670171161990467, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b823e6010088ad528237b98f4644cd81", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\u0004\ufffd\u001e6\u001b\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\u0004\ufffd\u001e6\u001b\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\u0004\ufffd\u001e6\u001b\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\u0004\ufffd\u001e6\u001b\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\u0004\ufffd\u001e6\u001b\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28406f950eadbb814f286f83d1e9a04d636cd01a", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\u0004\ufffd\u001e6\u001b\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\u0004\ufffd\u001e6\u001b\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffd\ufffd#\ufffd\|\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��³K�=��z�lϡL�b�E� K�� Ϥ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��³K�=��z�lϡL�b�E� K�� Ϥ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4e5e5b9030d762caf3e0fa8f84ffa35e", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u0015\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e4\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u0015\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e4\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u0015\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e4\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u0015\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e4\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u0015\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e4\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c26306585ff0bd2bf7c33c046b3615219e112410", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u0015\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e4\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03e4", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u0015\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e4\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\u00b3K\ufffd=\ufffd\ufffdz\ufffdl\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03e4", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �� 3��F��W�D��B!1I�� O<�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��3��F��W�D��B!1I�� O<�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4c8e117e0637bb9faccb82edff5f30e2", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffd\f3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffd\f3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffd\f3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffd\f3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffd\f3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5497093dafd593a4e86252ff0d5d0642ff478a61", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffd\f3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffd\f3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffdF\ufffd\ufffdW\ufffdD\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R\|��^�I��ぇԃI4��eh�B��M�n8� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R\|��^�I��ぇԃI4��eh�B��M�n8� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bd9ee703ddfdce4034f812107c51a0ae", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001a\ufffd^\u0011\ufffdI\ufffd\ufffd\u3047\u0503I4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001a\ufffd^\u0011\ufffdI\ufffd\ufffd\u3047\u0503I4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001a\ufffd^\u0011\ufffdI\ufffd\ufffd\u3047\u0503I4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001a\ufffd^\u0011\ufffdI\ufffd\ufffd\u3047\u0503I4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001a\ufffd^\u0011\ufffdI\ufffd\ufffd\u3047\u0503I4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fda74b31a5a38cd6f5d6af0cc054e7d9ebf3a0f4", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001a\ufffd^\u0011\ufffdI\ufffd\ufffd\u3047\u0503I4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\|\ufffd\ufffd\ufffd^\ufffdI\ufffd\ufffd\u3047\u0503I4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001a\ufffd^\u0011\ufffdI\ufffd\ufffd\u3047\u0503I4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\|\ufffd\ufffd\ufffd^\ufffdI\ufffd\ufffd\u3047\u0503I4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&T�]�^D��z��]dm�h�D�E�LK$�˥ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&T�]�^D��z��]dm�h�D�E�LK$�˥ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.518419433198016, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2a6d11dce0c80ca65c151a7b0fbef296", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd]\u000e\ufffd^\u001d\u0003D\ufffd\ufffdz\ufffd\ufffd]dm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e5\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd]\u000e\ufffd^\u001d\u0003D\ufffd\ufffdz\ufffd\ufffd]dm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e5\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd]\u000e\ufffd^\u001d\u0003D\ufffd\ufffdz\ufffd\ufffd]dm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e5\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd]\u000e\ufffd^\u001d\u0003D\ufffd\ufffdz\ufffd\ufffd]dm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e5\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd]\u000e\ufffd^\u001d\u0003D\ufffd\ufffdz\ufffd\ufffd]dm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e5\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d6c8078c950ed764e989afa4b15152bca206bb9", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd]\u000e\ufffd^\u001d\u0003D\ufffd\ufffdz\ufffd\ufffd]dm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e5\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd]\ufffd^D\ufffd\ufffdz\ufffd\ufffd]dm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02e5", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd]\u000e\ufffd^\u001d\u0003D\ufffd\ufffdz\ufffd\ufffd]dm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e5\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd]\ufffd^D\ufffd\ufffdz\ufffd\ufffd]dm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02e5", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)l��z��L��C�{5I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)l��z��L��C�{5I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.540386790286002, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "84411bbec333da3825d0965694b7b2cb", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0017\ufffd\u0006z\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0017\ufffd\u0006z\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0017\ufffd\u0006z\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0017\ufffd\u0006z\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0017\ufffd\u0006z\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "83d68b715068c4549b7bff482cb5bfaca2ecc5d9", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0017\ufffd\u0006z\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffdz\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0017\ufffd\u0006z\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffdz\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdC\ufffd{5I\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4�� %F��å�6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4��%F��å�6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.518263605669266, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6cf1e568199c6a5a3635e91e8e63506a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\ufffd\ufffd\u000b%\u0001F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd\u000f6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\ufffd\ufffd\u000b%\u0001F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd\u000f6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\ufffd\ufffd\u000b%\u0001F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd\u000f6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\ufffd\ufffd\u000b%\u0001F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd\u000f6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\ufffd\ufffd\u000b%\u0001F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd\u000f6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b1bbede7bf075abfd99c6ec153c01dd721e2a42", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\ufffd\ufffd\u000b%\u0001F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd\u000f6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\ufffd\ufffd%F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd\ufffd\ufffd\ufffd\u000b%\u0001F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd\u000f6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\ufffd\ufffd%F\ufffd\ufffd\ufffd\ufffd\u00e5\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��'Tڟ�A����'7�΅h�AH��dt� � Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��'Tڟ�A����'7�΅h�AH��dt� � Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5902799385401805, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bc09bf68a79025acec31e67f6f1a11f1", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd'T\u001a\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd'T\u001a\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd'T\u001a\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd'T\u001a\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd'T\u001a\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3020e325d8bc2f6bee63d1e265ff0711194077a3", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd'T\u001a\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd'T\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd'T\u001a\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd'T\u069f\ufffdA\ufffd\ufffd\ufffd\ufffd'7\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4��Tx(0�D��\��kepqC�NS,�K� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4��Tx(0�D��\��kepqC�NS,�K� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.548417508394124, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dab3fb5d2a2ea4bd77ddfd0c7204f57a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "74d6d3566fc755c322576de8e96fdf1ed7082579", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffdTx(0\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��@�&�1G�_tVCΌ��1� �wH��9�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��@�&�1G�_tVCΌ��1� �wH��9�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.6328331300295424, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "42735497a08d0de78b5ea5586c6e4f9f", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "77962f1fb686ae8d2f7d00126a3e4017dfcbe4f7", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd@\ufffd&\ufffd1G\ufffd_tVC\u038c\ufffd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"<�t_��&�J�$�y�}�Dq��x�L��,Pf�� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"<�t_��&�J�$�y�}�Dq��x�L��,Pf�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5902799385401805, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a02eb454fa082cbfbc93a07997a99f39", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fb05e45bc3557c933fd0c72cd7d598afd68ee287", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffdt_\ufffd\ufffd&\ufffdJ\ufffd$\ufffdy\ufffd}\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�0�-N�f@��c�z��&R\��7K��#h�._� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�0�-N�f@��c�z��&R\��7K��#h�._� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d4290b914d8a6a0aac76b0c73659eca", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u001d0\ufffd-N\ufffdf@\ufffd\ufffd\ufffd\u0016c\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u001d0\ufffd-N\ufffdf@\ufffd\ufffd\ufffd\u0016c\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u001d0\ufffd-N\ufffdf@\ufffd\ufffd\ufffd\u0016c\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u001d0\ufffd-N\ufffdf@\ufffd\ufffd\ufffd\u0016c\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u001d0\ufffd-N\ufffdf@\ufffd\ufffd\ufffd\u0016c\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b8d5a71ae993810c87ba6813bb5e7f24235ab899", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u001d0\ufffd-N\ufffdf@\ufffd\ufffd\ufffd\u0016c\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd0\ufffd-N\ufffdf@\ufffd\ufffd\ufffdc\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u001d0\ufffd-N\ufffdf@\ufffd\ufffd\ufffd\u0016c\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd0\ufffd-N\ufffdf@\ufffd\ufffd\ufffdc\ufffdz\ufffd\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R8��M��jI��G�N��(�v�LN�&�(�/6� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R8��M��jI��G�N��(�v�LN�&�(�/6� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5902799385401805, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3e61b9c940fd24242d1c8c46848eed2e", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\u0012\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\u0012\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\u0012\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\u0012\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\u0012\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "64f7caaf9c29408ddaf2f4953608ca8c1d1510a2", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\u0012\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd\u0012\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\ufffdM\ufffd\ufffdjI\ufffd\ufffd\ufffd\ufffdG\ufffdN\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RPښ��G��L��S��W��WIK��x��B� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RPښ��G��L��S��W��WIK��x��B� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.547726747050819, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c1cf526eb2d85903e3a8aebf5f6a1996", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3c9ad1a8a16701f17219c0c8a6d453cc7228224", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRP\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRP\u069a\ufffd\ufffdG\ufffd\ufffdL\ufffd\ufffdS\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�ROI��B�78�W�L歽rvA�U�X�m� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�ROI��B�78�W�L歽rvA�U�X�m� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.611556534284861, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fd9b1a9958d8f3ec530b76f1f09f790e", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000OI\ufffd\ufffd\ufffd\ufffdB\ufffd\u001478\ufffdW\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000OI\ufffd\ufffd\ufffd\ufffdB\ufffd\u001478\ufffdW\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000OI\ufffd\ufffd\ufffd\ufffdB\ufffd\u001478\ufffdW\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000OI\ufffd\ufffd\ufffd\ufffdB\ufffd\u001478\ufffdW\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000OI\ufffd\ufffd\ufffd\ufffdB\ufffd\u001478\ufffdW\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "628b23ba02a44098175fab23ebbbab7ec0d74728", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000OI\ufffd\ufffd\ufffd\ufffdB\ufffd\u001478\ufffdW\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdROI\ufffd\ufffd\ufffd\ufffdB\ufffd78\ufffdW\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000OI\ufffd\ufffd\ufffd\ufffdB\ufffd\u001478\ufffdW\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdROI\ufffd\ufffd\ufffd\ufffdB\ufffd78\ufffdW\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��4�[��KN�%LDש��w�M�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��4�[��KN�%LDש��w�M�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.60352581617674, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e5e598e92e6629f4618fcea3bcb01524", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd4\ufffd[\ufffd\ufffdKN\ufffd\u0003%LD\u05e9\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd4\ufffd[\ufffd\ufffdKN\ufffd\u0003%LD\u05e9\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd4\ufffd[\ufffd\ufffdKN\ufffd\u0003%LD\u05e9\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd4\ufffd[\ufffd\ufffdKN\ufffd\u0003%LD\u05e9\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd4\ufffd[\ufffd\ufffdKN\ufffd\u0003%LD\u05e9\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1fb91d6862e916b82384d775043791032c6aa945", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd4\ufffd[\ufffd\ufffdKN\ufffd\u0003%LD\u05e9\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd4\ufffd[\ufffd\ufffdKN\ufffd%LD\u05e9\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000\ufffd4\ufffd[\ufffd\ufffdKN\ufffd\u0003%LD\u05e9\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd4\ufffd[\ufffd\ufffdKN\ufffd%LD\u05e9\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R%�-6[�~�H��&�^g��J��L��ͅ� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R%�-6[�~�H��&�^g��J��L��ͅ� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903623, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b71408ef8a1e2e0aa7b22c4640378fc4", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0014-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0014-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0014-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0014-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0014-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6a5902ee578ea62843489e5d1d141921b54c9704", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0014-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR%\ufffd-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\u0014-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR%\ufffd-6[\ufffd~\ufffdH\ufffd\ufffd\ufffd&\ufffd^g\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��/2��'F��wa�<��dd_�D��,N�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��/2��'F��wa�<��dd_�D��,N�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7713c7293c8772bfd86054b694f3fb0b", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\/2\ufffd\b\ufffd'F\ufffd\u000e\ufffdwa\u0019\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\/2\ufffd\b\ufffd'F\ufffd\u000e\ufffdwa\u0019\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\/2\ufffd\b\ufffd'F\ufffd\u000e\ufffdwa\u0019\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\/2\ufffd\b\ufffd'F\ufffd\u000e\ufffdwa\u0019\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\/2\ufffd\b\ufffd'F\ufffd\u000e\ufffdwa\u0019\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d1c32b8f2c36615f58093951b5b050938e1b3b03", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\/2\ufffd\b\ufffd'F\ufffd\u000e\ufffdwa\u0019\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\/2\ufffd\ufffd'F\ufffd\ufffdwa\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\/2\ufffd\b\ufffd'F\ufffd\u000e\ufffdwa\u0019\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\/2\ufffd\ufffd'F\ufffd\ufffdwa\ufffd<\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R'�r~��I�2; ː�2��cþA�F-�4j� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R'�r~��I�2; ː�2��cþA�F-�4j� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137665, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d1f47fbd64bf91736d4e920bd4476698", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffdr~\ufffd\ufffdI\ufffd2\u0016;\n\u02d0\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffdr~\ufffd\ufffdI\ufffd2\u0016;\n\u02d0\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffdr~\ufffd\ufffdI\ufffd2\u0016;\n\u02d0\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffdr~\ufffd\ufffdI\ufffd2\u0016;\n\u02d0\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffdr~\ufffd\ufffdI\ufffd2\u0016;\n\u02d0\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b240f3ccd5b2e7fffaa60602ac85752bc42e896f", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffdr~\ufffd\ufffdI\ufffd2\u0016;\n\u02d0\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR'\ufffdr~\ufffd\ufffdI\ufffd2;\n\u02d0\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000\ufffdr~\ufffd\ufffdI\ufffd2\u0016;\n\u02d0\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR'\ufffdr~\ufffd\ufffdI\ufffd2;\n\u02d0\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�F��`L̬F�觖�A�!��XM�F� ؎�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�F��`L̬F�觖�A�!��XM�F� ؎�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903622, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3a82ed6d3fce4484096bdcf23447a312", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000F\ufffd\ufffd`L\u032cF\ufffd\u001d\u89d6\ufffdA\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000F\ufffd\ufffd`L\u032cF\ufffd\u001d\u89d6\ufffdA\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000F\ufffd\ufffd`L\u032cF\ufffd\u001d\u89d6\ufffdA\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000F\ufffd\ufffd`L\u032cF\ufffd\u001d\u89d6\ufffdA\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000F\ufffd\ufffd`L\u032cF\ufffd\u001d\u89d6\ufffdA\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "862cf17ae5b03c7b29eaaf95886afdd5e2ed844c", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000F\ufffd\ufffd`L\u032cF\ufffd\u001d\u89d6\ufffdA\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdF\ufffd\ufffd`L\u032cF\ufffd\u89d6\ufffdA\ufffd!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000F\ufffd\ufffd`L\u032cF\ufffd\u001d\u89d6\ufffdA\ufffd\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdF\ufffd\ufffd`L\u032cF\ufffd\u89d6\ufffdA\ufffd!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"�s$7 ��K�"u�Y��H��@q��G��X�vni� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"�s$7 ��K�"u�Y��H��@q��G��X�vni� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.654109725774223, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9b467a948f8baa7b1a2edf12d35919f2", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000s$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000s$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000s$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000s$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000s$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "40e49a59c776d318b5316ad185331ce2f0a9319d", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000s$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"\ufffds$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000s$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"\ufffds$7\r\ufffd\ufffd\ufffdK\ufffd\"u\ufffdY\ufffd\ufffdH\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R@��Ru@�X��o��y��ԳH�j�ց沦 Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R@��Ru@�X��o��y��ԳH�j�ց沦 Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f7ba44ff0106771f2f1965305cd03fdf", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\ufffd\u0014\ufffdRu@\ufffdX\ufffd\ufffd\u0019o\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6ca6\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\ufffd\u0014\ufffdRu@\ufffdX\ufffd\ufffd\u0019o\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6ca6\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\ufffd\u0014\ufffdRu@\ufffdX\ufffd\ufffd\u0019o\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6ca6\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\ufffd\u0014\ufffdRu@\ufffdX\ufffd\ufffd\u0019o\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6ca6\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\ufffd\u0014\ufffdRu@\ufffdX\ufffd\ufffd\u0019o\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6ca6\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "340ca2332015a1d704bdb8b73560224c14065929", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\ufffd\u0014\ufffdRu@\ufffdX\ufffd\ufffd\u0019o\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6ca6\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR@\ufffd\ufffd\ufffd\ufffdRu@\ufffdX\ufffd\ufffdo\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6ca6", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\ufffd\ufffd\ufffd\u0014\ufffdRu@\ufffdX\ufffd\ufffd\u0019o\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6ca6\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR@\ufffd\ufffd\ufffd\ufffdRu@\ufffdX\ufffd\ufffdo\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6ca6", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R̭HQ��L�/��8�_ek��@��n��z�� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R̭HQ��L�/��8�_ek��@��n��z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137665, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7d7be497f5ddb094cf3399330f8762e9", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "93d996d9a6da52f7c168d39c68c4f5725418ddce", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\u032dHQ\ufffd\ufffd\ufffdL\ufffd\/\ufffd\ufffd8\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�Rd� �Ai��E��e� G4��D~?K�KiSY?�[� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�Rd� �Ai��E��e� G4��D~?K�KiSY?�[� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392985, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8affe54163842ce1e671c0af16287c88", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ce8bab4b5a10cbb34f0a8212fad68cb8d635582f", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\t\ufffdAi\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffde\ufffd\nG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�m-�hٜ�D�S�� f�P�B � �K�;�}7�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�m-�hٜ�D�S��f�P�B ��K�;�}7�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.585064779011745, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8bf746edb351398ae0bc4d1b79ce26d1", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000m-\ufffdh\u065c\ufffdD\ufffdS\ufffd\u0004\ufffd\ff\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000m-\ufffdh\u065c\ufffdD\ufffdS\ufffd\u0004\ufffd\ff\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000m-\ufffdh\u065c\ufffdD\ufffdS\ufffd\u0004\ufffd\ff\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000m-\ufffdh\u065c\ufffdD\ufffdS\ufffd\u0004\ufffd\ff\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000m-\ufffdh\u065c\ufffdD\ufffdS\ufffd\u0004\ufffd\ff\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "70ef65999dd57468127172994073cca3b7e12214", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000m-\ufffdh\u065c\ufffdD\ufffdS\ufffd\u0004\ufffd\ff\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdm-\ufffdh\u065c\ufffdD\ufffdS\ufffd\ufffdf\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000m-\ufffdh\u065c\ufffdD\ufffdS\ufffd\u0004\ufffd\ff\ufffdP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdm-\ufffdh\u065c\ufffdD\ufffdS\ufffd\ufffdf\ufffdP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��Ҭ�u�@�"r�r�ϡL�b�E� K�� ϥ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��Ҭ�u�@�"r�r�ϡL�b�E� K�� ϥ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.577034060903621, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8dda4fb6c9c54832f0124f8f237e9de3", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"\u001c\u0011r\ufffdr\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e5\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"\u001c\u0011r\ufffdr\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e5\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"\u001c\u0011r\ufffdr\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e5\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"\u001c\u0011r\ufffdr\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e5\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"\u001c\u0011r\ufffdr\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e5\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "849216c5fd19278e37d100874bf92dd1b35be251", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"\u001c\u0011r\ufffdr\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e5\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"r\ufffdr\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03e5", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"\u001c\u0011r\ufffdr\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03e5\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\u04ac\ufffdu\ufffd@\ufffd\"r\ufffdr\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03e5", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �sۛ9��uG�~�D��B!1I�� O<�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R �sۛ9��uG�~�D��B!1I�� O<�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137665, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cff4fdb9451c6671f391adc3bad15227", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000s\u06db9\ufffd\ufffduG\ufffd~\ufffdD\u001a\u0018\u0002\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000s\u06db9\ufffd\ufffduG\ufffd~\ufffdD\u001a\u0018\u0002\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000s\u06db9\ufffd\ufffduG\ufffd~\ufffdD\u001a\u0018\u0002\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000s\u06db9\ufffd\ufffduG\ufffd~\ufffdD\u001a\u0018\u0002\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000s\u06db9\ufffd\ufffduG\ufffd~\ufffdD\u001a\u0018\u0002\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "98106fd91aa56fa66017537ace512d7e5a1aee5b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000s\u06db9\ufffd\ufffduG\ufffd~\ufffdD\u001a\u0018\u0002\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\r\ufffds\u06db9\ufffd\ufffduG\ufffd~\ufffdD\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000s\u06db9\ufffd\ufffduG\ufffd~\ufffdD\u001a\u0018\u0002\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\r\ufffds\u06db9\ufffd\ufffduG\ufffd~\ufffdD\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��A�4�6N��{��wn��.�C��E��2��F�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��A�4�6N��{��wn��.�C��E��2��F�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.633523891372847, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bc4911c2c768c1d52d2c32136d1c6256", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffdA\ufffd4\ufffd\u00016N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffdA\ufffd4\ufffd\u00016N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffdA\ufffd4\ufffd\u00016N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffdA\ufffd4\ufffd\u00016N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffdA\ufffd4\ufffd\u00016N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8a6d3d46ab1355caa692dad920a7f0fba3e0a04b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffdA\ufffd4\ufffd\u00016N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffdA\ufffd4\ufffd6N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000\ufffdA\ufffd4\ufffd\u00016N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR \ufffd\ufffdA\ufffd4\ufffd6N\ufffd\ufffd{\ufffd\ufffdwn\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R\|��!^H@��[��4��eh�B��M�n8� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R\|��!^H@��[��4��eh�B��M�n8� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e0904d730267f7044783c2d6cf0259f8", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001b\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001b\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001b\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001b\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001b\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b659d03d785190e9bcbf52292626a3610dc60f86", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001b\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\|\ufffd\ufffd\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000\ufffd\ufffd\u001b\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\|\ufffd\ufffd\ufffd!^H@\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&Tw��4�C��T5Mm�h�D�E�LK$�˦ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&Tw��4�C��T5Mm�h�D�E�LK$�˦ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.582249220432058, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "57031b0aac89c81d3a8a88ba022e6cdb", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000w\u0014\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e6\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000w\u0014\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e6\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000w\u0014\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e6\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000w\u0014\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e6\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000w\u0014\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e6\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "280fbb4faf09576e956716e80eda0533eb1fae73", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000w\u0014\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e6\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&Tw\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02e6", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000w\u0014\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02e6\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&Tw\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdT5Mm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02e6", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)l@;��q�>E��Ĥ��I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)l@;��q�>E��Ĥ��I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.527140912649442, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "75735441889d23c3600d2b5d1dd25be6", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "339c3fbe714d078202620037b6f4dfb4d62d69f4", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)l@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)l@;\ufffd\ufffdq\ufffd>E\ufffd\ufffd\ufffd\ufffd\u0124\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4�A�܋�!G��z�U4]J6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4�A�܋�!G��z�U4]J6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138804, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ef9e56887125248c7577d21c25498101", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "64e066c40e060893d0f72ad6df4422c1867783cc", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffdA\ufffd\u070b\ufffd!G\ufffd\ufffdz\ufffdU4]J6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��1hlFkB�� D�Y΅h�AH��dt� � Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��1hlFkB��D�Y΅h�AH��dt� � Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0c3e3efca079df101e139ceb2d59bef1", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd1hlFkB\ufffd\u0014\ufffd\ufffd\u000bD\ufffdY\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd1hlFkB\ufffd\u0014\ufffd\ufffd\u000bD\ufffdY\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd1hlFkB\ufffd\u0014\ufffd\ufffd\u000bD\ufffdY\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd1hlFkB\ufffd\u0014\ufffd\ufffd\u000bD\ufffdY\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd1hlFkB\ufffd\u0014\ufffd\ufffd\u000bD\ufffdY\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60f62b318f0b1adfcb2688f01ae15820310b5c78", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd1hlFkB\ufffd\u0014\ufffd\ufffd\u000bD\ufffdY\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd1hlFkB\ufffd\ufffd\ufffdD\ufffdY\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffd1hlFkB\ufffd\u0014\ufffd\ufffd\u000bD\ufffdY\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd1hlFkB\ufffd\ufffd\ufffdD\ufffdY\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�F��}<y@�%t� 4,��1� �wH��9�7� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�F��}<y@�%t� 4,��1� �wH��9�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.563788183267063, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "19c6bf8e352c97810b9174593c0d53ed", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000F\ufffd\ufffd}<y@\ufffd\u0004%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000F\ufffd\ufffd}<y@\ufffd\u0004%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000F\ufffd\ufffd}<y@\ufffd\u0004%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000F\ufffd\ufffd}<y@\ufffd\u0004%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000F\ufffd\ufffd}<y@\ufffd\u0004%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c9b485c3856aa5d88a6f19553167e20ff09d8ce5", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000F\ufffd\ufffd}<y@\ufffd\u0004%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdF\ufffd\ufffd}<y@\ufffd%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000F\ufffd\ufffd}<y@\ufffd\u0004%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdF\ufffd\ufffd}<y@\ufffd%t\ufffd 4,\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4��<җ�M�Ţ�`�ؘ��kepqC�NS,�K� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4��<җ�M�Ţ�`�ؘ��kepqC�NS,�K� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569694104138804, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1ef1c706cb9da7d8873c4a4dc235d76e", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ac878d8447afdc890ac57a8694866c7d34f7dd0c", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffd\ufffd\ufffd<\u0497\ufffdM\ufffd\u0162\ufffd`\ufffd\u0618\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"<��T��F�r��S�?Dq��x�L��,Pf�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"<��T��F�r��S�?Dq��x�L��,Pf�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cf461dabe6edf41f6a2fd3b41c681073", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffd\ufffd\u0002\ufffdT\ufffd\ufffdF\ufffdr\ufffd\u0005\ufffdS\ufffd?Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffd\ufffd\u0002\ufffdT\ufffd\ufffdF\ufffdr\ufffd\u0005\ufffdS\ufffd?Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffd\ufffd\u0002\ufffdT\ufffd\ufffdF\ufffdr\ufffd\u0005\ufffdS\ufffd?Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffd\ufffd\u0002\ufffdT\ufffd\ufffdF\ufffdr\ufffd\u0005\ufffdS\ufffd?Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffd\ufffd\u0002\ufffdT\ufffd\ufffdF\ufffdr\ufffd\u0005\ufffdS\ufffd?Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2fb9d0ec7dc476487e0d3cf313cf9c660bd47e13", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffd\ufffd\u0002\ufffdT\ufffd\ufffdF\ufffdr\ufffd\u0005\ufffdS\ufffd?Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffdr\ufffd\ufffdS\ufffd?Dq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\ufffd\ufffd\u0002\ufffdT\ufffd\ufffdF\ufffdr\ufffd\u0005\ufffdS\ufffd?Dq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffdr\ufffd\ufffdS\ufffd?Dq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:55 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��u�oR�I��0,�ϖ&R\��7K��#h�._� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��u�oR�I��0,�ϖ&R\��7K��#h�._� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5690033427955, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "89c064ef248760f2fa2a81e408d12c27", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffdu\ufffd\u0003oR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffdu\ufffd\u0003oR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffdu\ufffd\u0003oR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffdu\ufffd\u0003oR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffdu\ufffd\u0003oR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dff6019458683fe7410b32fdf562d6eb74aa755b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffdu\ufffd\u0003oR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdu\ufffdoR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\ufffdu\ufffd\u0003oR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdu\ufffdoR\ufffdI\ufffd\ufffd\ufffd\ufffd0,\ufffd\u03d6&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:54 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)l��TEY�N�1�R�"��I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)l��TEY�N�1�R�"��I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.519110194541321, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0e8024f860dfd1b303416bb8ae42b34d", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0003\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0003\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0003\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0003\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0003\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4fdcf7ce8f23fda06f35725817ae0215c50d5303", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0003\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd\u0003\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd\ufffdTEY\ufffdN\ufffd1\ufffdR\ufffd\"\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:02:54 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4�?yo �I@��:��e6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4�?yo�I@��:��e6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.561663386030682, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "706df112b595e9c8a3f67f63f5f16b6f", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd?yo\u000b\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffd\u0007e6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd?yo\u000b\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffd\u0007e6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd?yo\u000b\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffd\u0007e6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd?yo\u000b\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffd\u0007e6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd?yo\u000b\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffd\u0007e6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6fbab1e0498e3bbbf62df8082c87da193273b96f", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd?yo\u000b\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffd\u0007e6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffd?yo\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffde6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000\ufffd?yo\u000b\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffd\u0007e6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffd?yo\ufffdI@\ufffd\ufffd\ufffd:\ufffd\ufffde6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }

1.226.4.189

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence