{"ip":"103.91.170.110","exported_at":"2026-10-25T06:37:16+00:00","period_days":30,"metrics":{"events7d":2735,"distinct_ports":1,"distinct_classifications":2,"max_severity":6,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":35,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["database_scan"],"recommended_action":"monitor","confidence":0.95,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":25},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":2735,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":25,"risk_score":35},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":95,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0519","Upstream"],"tags_summary":["pat-0519","INT-upstream"],"attack_vector":"mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)","protocol_details":{"mssql_tds_fr":"Connexion TDS Microsoft SQL Server","payload_preview":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000\u0017\ufffd\u0000m\ufffdj\u009c\ufffd\u001bJ\ufffd\u0016\u0003\ufffdA\u06eb\ufffd%\ufffd\u0010\ufffds\ufffdI@\ufffd\ufffd\u0014Q\u0019\ufffd\u0012f\ufffd\n\u0000\u0000\u0001","port":1433,"service":"mssql","service_label_fr":"MSSQL"},"protocol_summary_fr":"Payload \u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000\u0017\ufffd\u0000m\ufffdj\u009c\ufffd\u001b\u2026 \u00b7 MSSQL:1433","evidence_snippet":"^$*+,01$U\ufffdR\ufffdm\ufffdj\u009c\ufffdJ\ufffd\ufffdA\u06eb\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd","target_port_label":"1433 \u00b7 MSSQL","emulator_service":"mssql","confidence_reason":"Confiance 95 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Rafale d\u0027authentification SSH \u00b7 confiance 95%","classification_reason_label_fr":"Rafale d\u0027authentification SSH \u00b7 confiance 95%","confidence_factors_fr":"Confiance 95 % \u2014 Score WAF 8","payload_preview":"^$*+,01$U\ufffdR\ufffdm\ufffdj\u009c\ufffdJ\ufffd\ufffdA\u06eb\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"110.170.91.103.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":6321146,"ip":"103.91.170.110","ts":"2026-10-22 02:27:35.000000","proto":"tcp","src_port":64477,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6597408429335925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229ebd89da3be5155c001474808e357738\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000m\ufffdj\u009c\ufffd\\u001bJ\ufffd\\u0016\\u0003\ufffdA\u06eb\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000m\ufffdj\u009c\ufffd\\u001bJ\ufffd\\u0016\\u0003\ufffdA\u06eb\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000m\ufffdj\u009c\ufffd\\u001bJ\ufffd\\u0016\\u0003\ufffdA\u06eb\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000m\ufffdj\u009c\ufffd\\u001bJ\ufffd\\u0016\\u0003\ufffdA\u06eb\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000m\ufffdj\u009c\ufffd\\u001bJ\ufffd\\u0016\\u0003\ufffdA\u06eb\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ebaf0705f364e16b5f42bafbb6dd77fbe9977fc8\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000m\ufffdj\u009c\ufffd\\u001bJ\ufffd\\u0016\\u0003\ufffdA\u06eb\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffdm\ufffdj\u009c\ufffdJ\ufffd\ufffdA\u06eb\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000m\ufffdj\u009c\ufffd\\u001bJ\ufffd\\u0016\\u0003\ufffdA\u06eb\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffdm\ufffdj\u009c\ufffdJ\ufffd\ufffdA\u06eb\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321140,"ip":"103.91.170.110","ts":"2026-10-22 02:27:34.000000","proto":"tcp","src_port":64451,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.659740842933593, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226b10bd783a05c49c9afedcab297dc1bb\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd\\u0005+d%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd\\u0005+d%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd\\u0005+d%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd\\u0005+d%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd\\u0005+d%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223bf22fef018bd3cc644c2ee4e431c0eca8d94228\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd\\u0005+d%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd+d%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd\\u0005+d%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\u0390\ufffd\ufffd|\ufffd\ufffdE\ufffd\ufffdl\ufffd+d%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321139,"ip":"103.91.170.110","ts":"2026-10-22 02:27:34.000000","proto":"tcp","src_port":64422,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.681017438678274, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229175c0d0712b67e15e056b94fe4aa2b1\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd\\f?\ufffd\ufffd\u0182E%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd\\f?\ufffd\ufffd\u0182E%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd\\f?\ufffd\ufffd\u0182E%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd\\f?\ufffd\ufffd\u0182E%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd\\f?\ufffd\ufffd\u0182E%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f06dc4c3df69254096f43730445d0549b1af9fbc\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd\\f?\ufffd\ufffd\u0182E%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd?\ufffd\ufffd\u0182E%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd\\f?\ufffd\ufffd\u0182E%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\u064a\ufffdg\ufffd\ufffdJ\ufffd?\ufffd\ufffd\u0182E%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321131,"ip":"103.91.170.110","ts":"2026-10-22 02:27:33.000000","proto":"tcp","src_port":64401,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.651710124825471, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f7bad13db9ee039b26dc5329bbc94298\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000vz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\\u0006\ufffdSL%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000vz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\\u0006\ufffdSL%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000vz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\\u0006\ufffdSL%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000vz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\\u0006\ufffdSL%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000vz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\\u0006\ufffdSL%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cf58ef8f95c81d473db1f70982950f21f0f89846\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000vz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\\u0006\ufffdSL%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffdvz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\ufffdSL%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000vz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\\u0006\ufffdSL%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffdvz\ufffdj\ufffd\ufffd\ufffdO\ufffd\\r\ufffd\ufffd\ufffdSL%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321129,"ip":"103.91.170.110","ts":"2026-10-22 02:27:33.000000","proto":"tcp","src_port":64372,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.638464247188912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dc943a1383d45b04e362868e0adfff08\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffd\\u0010H#%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffd\\u0010H#%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffd\\u0010H#%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffd\\u0010H#%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffd\\u0010H#%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222711a6ab9d04916d79ada423e787daa6f7bb8860\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffd\\u0010H#%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffdH#%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffd\\u0010H#%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdeH\ufffd\ufffdJ\ufffd\ufffdH#%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321124,"ip":"103.91.170.110","ts":"2026-10-22 02:27:32.000000","proto":"tcp","src_port":64343,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.723570630167635, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b4bed1dd1a65c8a128a2009d3a400ed0\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000 \ufffd\ufffd\ufffdF|\ufffdM\ufffd\\u001b[e)\ufffd6\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000 \ufffd\ufffd\ufffdF|\ufffdM\ufffd\\u001b[e)\ufffd6\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000 \ufffd\ufffd\ufffdF|\ufffdM\ufffd\\u001b[e)\ufffd6\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000 \ufffd\ufffd\ufffdF|\ufffdM\ufffd\\u001b[e)\ufffd6\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000 \ufffd\ufffd\ufffdF|\ufffdM\ufffd\\u001b[e)\ufffd6\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c2d3cded6f44223f45b59b6a6608e2626ea6e764\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000 \ufffd\ufffd\ufffdF|\ufffdM\ufffd\\u001b[e)\ufffd6\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd \ufffd\ufffd\ufffdF|\ufffdM\ufffd[e)\ufffd6\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000 \ufffd\ufffd\ufffdF|\ufffdM\ufffd\\u001b[e)\ufffd6\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd \ufffd\ufffd\ufffdF|\ufffdM\ufffd[e)\ufffd6\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321117,"ip":"103.91.170.110","ts":"2026-10-22 02:27:31.000000","proto":"tcp","src_port":64325,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.689048156786396, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002286117ac25022517f4eea1cada16a6ea2\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u00005P\ufffd\ufffd\\u0004d]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u00005P\ufffd\ufffd\\u0004d]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u00005P\ufffd\ufffd\\u0004d]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u00005P\ufffd\ufffd\\u0004d]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u00005P\ufffd\ufffd\\u0004d]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002288a1c646a9912dd2d15d19a86c2008c9ac89a7d9\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u00005P\ufffd\ufffd\\u0004d]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd5P\ufffd\ufffdd]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u00005P\ufffd\ufffd\\u0004d]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd5P\ufffd\ufffdd]G\ufffd\ufffd[\ufffdB\ufffdrA%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321114,"ip":"103.91.170.110","ts":"2026-10-22 02:27:31.000000","proto":"tcp","src_port":64294,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.614256682922033, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224f2151b57772f334a26e47391e536780\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000+\ufffd\ufffd,\\u0000r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000+\ufffd\ufffd,\\u0000r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000+\ufffd\ufffd,\\u0000r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000+\ufffd\ufffd,\\u0000r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000+\ufffd\ufffd,\\u0000r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022626a3d66a418b84e10068662008be3e3b199689d\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000+\ufffd\ufffd,\\u0000r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd+\ufffd\ufffd,r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000+\ufffd\ufffd,\\u0000r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd+\ufffd\ufffd,r`L\ufffd\ufffd\u0240q\ufffdy\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321109,"ip":"103.91.170.110","ts":"2026-10-22 02:27:31.000000","proto":"tcp","src_port":64280,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6597408429335925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e3d4294e65b38c48beee7667f1fa4485\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c040ca086babdeffaf70164d42759784e9d3892a\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd%\u06b4\ufffds\ufffdK\ufffd\ufffd\ufffdH\ufffd|\ufffdF%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321105,"ip":"103.91.170.110","ts":"2026-10-22 02:27:30.000000","proto":"tcp","src_port":64262,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.723570630167635, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fa318db3002db918b9958575ddeaf606\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u001d;\ufffd(dN\ufffd\\u0007i\\\u0022\\u000e\ufffd\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u001d;\ufffd(dN\ufffd\\u0007i\\\u0022\\u000e\ufffd\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u001d;\ufffd(dN\ufffd\\u0007i\\\u0022\\u000e\ufffd\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u001d;\ufffd(dN\ufffd\\u0007i\\\u0022\\u000e\ufffd\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u001d;\ufffd(dN\ufffd\\u0007i\\\u0022\\u000e\ufffd\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c07ac5ef755b9facddcbc8c859283b8136d67f73\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u001d;\ufffd(dN\ufffd\\u0007i\\\u0022\\u000e\ufffd\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd;\ufffd(dN\ufffdi\\\u0022\ufffd\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u001d;\ufffd(dN\ufffd\\u0007i\\\u0022\\u000e\ufffd\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd;\ufffd(dN\ufffdi\\\u0022\ufffd\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321101,"ip":"103.91.170.110","ts":"2026-10-22 02:27:29.000000","proto":"tcp","src_port":64228,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.59591105569955, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222e067337e11acea562d44f1f3fe452dc\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffdx\\u000fTK\ufffd\ufffd\ufffd\\u0005\ufffd\\u0015\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffdx\\u000fTK\ufffd\ufffd\ufffd\\u0005\ufffd\\u0015\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffdx\\u000fTK\ufffd\ufffd\ufffd\\u0005\ufffd\\u0015\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffdx\\u000fTK\ufffd\ufffd\ufffd\\u0005\ufffd\\u0015\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffdx\\u000fTK\ufffd\ufffd\ufffd\\u0005\ufffd\\u0015\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221e6f3b12c66f7099fc4f1358e7137c0ccbc759eb\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffdx\\u000fTK\ufffd\ufffd\ufffd\\u0005\ufffd\\u0015\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffdxTK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd\ufffdx\\u000fTK\ufffd\ufffd\ufffd\\u0005\ufffd\\u0015\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffdxTK\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321098,"ip":"103.91.170.110","ts":"2026-10-22 02:27:29.000000","proto":"tcp","src_port":64212,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.609156933336109, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002236545519d6abe91f6e3bc314090a325a\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000E\ufffd:\\u001d\ufffd\ufffdO\ufffd\\u001d\ufffd\ufffdfE\\u0006Z%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000E\ufffd:\\u001d\ufffd\ufffdO\ufffd\\u001d\ufffd\ufffdfE\\u0006Z%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000E\ufffd:\\u001d\ufffd\ufffdO\ufffd\\u001d\ufffd\ufffdfE\\u0006Z%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000E\ufffd:\\u001d\ufffd\ufffdO\ufffd\\u001d\ufffd\ufffdfE\\u0006Z%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000E\ufffd:\\u001d\ufffd\ufffdO\ufffd\\u001d\ufffd\ufffdfE\\u0006Z%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220a4ef6e3fe689fa46a8d3d91e12e03725a70683b\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000E\ufffd:\\u001d\ufffd\ufffdO\ufffd\\u001d\ufffd\ufffdfE\\u0006Z%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffdE\ufffd:\ufffd\ufffdO\ufffd\ufffd\ufffdfEZ%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000E\ufffd:\\u001d\ufffd\ufffdO\ufffd\\u001d\ufffd\ufffdfE\\u0006Z%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffdE\ufffd:\ufffd\ufffdO\ufffd\ufffd\ufffdfEZ%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321093,"ip":"103.91.170.110","ts":"2026-10-22 02:27:28.000000","proto":"tcp","src_port":64187,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.617187651444231, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222a4d57094b0ea243026882d858ee06a9\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022587b55c0a8699cdc7a4784d4867c4c1185109926\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd!\ufffd\ufffdb0X@\ufffd\ufffd3U\ufffd\ufffd\ufffd5%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321090,"ip":"103.91.170.110","ts":"2026-10-22 02:27:28.000000","proto":"tcp","src_port":64163,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.681017438678274, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b32054942cf505746345302fe82ea68\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffd\\u000fn%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffd\\u000fn%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffd\\u000fn%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffd\\u000fn%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffd\\u000fn%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d4f3ab5b4761150072c4249e65baae14f8725fc0\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffd\\u000fn%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffdn%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffd\\u000fn%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffdI]xK\ufffdoA\ufffd\\r\ufffd\ufffdw\ufffdn%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321084,"ip":"103.91.170.110","ts":"2026-10-22 02:27:27.000000","proto":"tcp","src_port":64128,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.7022940344229545, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c0431c24961cd1b48328f42f3a785a69\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd`\ufffd\\u001d\\r\u0793C\ufffd=\\u001d\u0026\ufffdL\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd`\ufffd\\u001d\\r\u0793C\ufffd=\\u001d\u0026\ufffdL\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd`\ufffd\\u001d\\r\u0793C\ufffd=\\u001d\u0026\ufffdL\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd`\ufffd\\u001d\\r\u0793C\ufffd=\\u001d\u0026\ufffdL\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd`\ufffd\\u001d\\r\u0793C\ufffd=\\u001d\u0026\ufffdL\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c2f1cf32532da358a93f5325041f541273939875\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd`\ufffd\\u001d\\r\u0793C\ufffd=\\u001d\u0026\ufffdL\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd`\ufffd\\r\u0793C\ufffd=\u0026\ufffdL\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd`\ufffd\\u001d\\r\u0793C\ufffd=\\u001d\u0026\ufffdL\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd`\ufffd\\r\u0793C\ufffd=\u0026\ufffdL\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321082,"ip":"103.91.170.110","ts":"2026-10-22 02:27:26.000000","proto":"tcp","src_port":64113,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.7022940344229545, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b5fdac17351248da82c5bb9804686801\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ed70db85309c439c9121000cc38cb53d35e9a0c6\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\\r\ufffd\ufffd\ufffd6!O\ufffd\ufffd?\ufffd-\ufffdi\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321076,"ip":"103.91.170.110","ts":"2026-10-22 02:27:26.000000","proto":"tcp","src_port":64081,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.646494965297034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dd3453a3bd9e442579ce8d1ba06747ab\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd,\ufffd\ufffdG\ufffd\\u0004\\u0005\ufffd\\u001f\\u001d2\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd,\ufffd\ufffdG\ufffd\\u0004\\u0005\ufffd\\u001f\\u001d2\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd,\ufffd\ufffdG\ufffd\\u0004\\u0005\ufffd\\u001f\\u001d2\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd,\ufffd\ufffdG\ufffd\\u0004\\u0005\ufffd\\u001f\\u001d2\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd,\ufffd\ufffdG\ufffd\\u0004\\u0005\ufffd\\u001f\\u001d2\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229dc9d471818f0e30f4257a59f838272eb22cb822\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd,\ufffd\ufffdG\ufffd\\u0004\\u0005\ufffd\\u001f\\u001d2\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffdG\ufffd\ufffd2\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd,\ufffd\ufffdG\ufffd\\u0004\\u0005\ufffd\\u001f\\u001d2\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffdG\ufffd\ufffd2\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321074,"ip":"103.91.170.110","ts":"2026-10-22 02:27:25.000000","proto":"tcp","src_port":64060,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.681017438678274, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022da1d56203299d2993cd32bb50ac2a459\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdtW\ufffd?\\u0015`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdtW\ufffd?\\u0015`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdtW\ufffd?\\u0015`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdtW\ufffd?\\u0015`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdtW\ufffd?\\u0015`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022682d3311d6674ef3cc0ac0dd0115441091af6bd8\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdtW\ufffd?\\u0015`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffdtW\ufffd?`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffdtW\ufffd?\\u0015`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffdtW\ufffd?`E\ufffdg\ufffd\ufffd\ufffdNq\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321070,"ip":"103.91.170.110","ts":"2026-10-22 02:27:25.000000","proto":"tcp","src_port":64036,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.638464247188912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ca999ca94fd891d6d775e7f349a1dead\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd6\\u0016\ufffd\ufffdB\\u000fO\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd6\\u0016\ufffd\ufffdB\\u000fO\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd6\\u0016\ufffd\ufffdB\\u000fO\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd6\\u0016\ufffd\ufffdB\\u000fO\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd6\\u0016\ufffd\ufffdB\\u000fO\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222e7743ee39934b14d2731e89a17c71ae3b5f90e6\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd6\\u0016\ufffd\ufffdB\\u000fO\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd6\ufffd\ufffdBO\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd6\\u0016\ufffd\ufffdB\\u000fO\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd6\ufffd\ufffdBO\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321062,"ip":"103.91.170.110","ts":"2026-10-22 02:27:24.000000","proto":"tcp","src_port":64017,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.638464247188912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002265f17c320102c9f1f423ff2be2ddb13f\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd\\u0016%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd\\u0016%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd\\u0016%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd\\u0016%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd\\u0016%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002236a6da9487d9b2da1578a141dfb7c55831fe5a2c\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd\\u0016%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd\\u0016%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd\ufffd\ufffd]\u0238,L\ufffd!qO \ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321059,"ip":"103.91.170.110","ts":"2026-10-22 02:27:24.000000","proto":"tcp","src_port":63987,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6597408429335925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224f860635b9e1eb2ca122da3d609ad172\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000#\ufffdE\ufffd\ufffd[\\u001aK\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000#\ufffdE\ufffd\ufffd[\\u001aK\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000#\ufffdE\ufffd\ufffd[\\u001aK\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000#\ufffdE\ufffd\ufffd[\\u001aK\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000#\ufffdE\ufffd\ufffd[\\u001aK\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e658fb12dcd0334500cc61f0b9b3487121d76115\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000#\ufffdE\ufffd\ufffd[\\u001aK\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd#\ufffdE\ufffd\ufffd[K\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000#\ufffdE\ufffd\ufffd[\\u001aK\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd#\ufffdE\ufffd\ufffd[K\ufffd\u49be\\nZ\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321053,"ip":"103.91.170.110","ts":"2026-10-22 02:27:23.000000","proto":"tcp","src_port":63964,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.7022940344229545, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c6f92bb65955d05aad69942e481aaf9d\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd#\ufffd\ufffdj\\u0003SJ\ufffd=cn\ufffd\/\ufffd\\u0013%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd#\ufffd\ufffdj\\u0003SJ\ufffd=cn\ufffd\/\ufffd\\u0013%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd#\ufffd\ufffdj\\u0003SJ\ufffd=cn\ufffd\/\ufffd\\u0013%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd#\ufffd\ufffdj\\u0003SJ\ufffd=cn\ufffd\/\ufffd\\u0013%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd#\ufffd\ufffdj\\u0003SJ\ufffd=cn\ufffd\/\ufffd\\u0013%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ce4eb44e794eb53cb11a1526b7a421b5edd0451c\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd#\ufffd\ufffdj\\u0003SJ\ufffd=cn\ufffd\/\ufffd\\u0013%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd#\ufffd\ufffdjSJ\ufffd=cn\ufffd\/\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd#\ufffd\ufffdj\\u0003SJ\ufffd=cn\ufffd\/\ufffd\\u0013%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd#\ufffd\ufffdjSJ\ufffd=cn\ufffd\/\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321049,"ip":"103.91.170.110","ts":"2026-10-22 02:27:22.000000","proto":"tcp","src_port":63936,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.681017438678274, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022574f911cd6fd82e6db0aa875cfcdba42\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd]\ufffd\u0026\ufffd\ufffd\\u0011K\ufffd`8!\ufffdp\\u0015x%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd]\ufffd\u0026\ufffd\ufffd\\u0011K\ufffd`8!\ufffdp\\u0015x%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd]\ufffd\u0026\ufffd\ufffd\\u0011K\ufffd`8!\ufffdp\\u0015x%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd]\ufffd\u0026\ufffd\ufffd\\u0011K\ufffd`8!\ufffdp\\u0015x%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd]\ufffd\u0026\ufffd\ufffd\\u0011K\ufffd`8!\ufffdp\\u0015x%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f4598a38b056b89b6b1393310d3ebe8788f7e047\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd]\ufffd\u0026\ufffd\ufffd\\u0011K\ufffd`8!\ufffdp\\u0015x%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd]\ufffd\u0026\ufffd\ufffdK\ufffd`8!\ufffdpx%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\ufffd]\ufffd\u0026\ufffd\ufffd\\u0011K\ufffd`8!\ufffdp\\u0015x%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\ufffd]\ufffd\u0026\ufffd\ufffdK\ufffd`8!\ufffdpx%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321042,"ip":"103.91.170.110","ts":"2026-10-22 02:27:22.000000","proto":"tcp","src_port":63911,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.7022940344229545, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226a6802a2d825876b7ca0ed6dec7c91ec\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000{Y\u003E\\u001a{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000{Y\u003E\\u001a{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000{Y\u003E\\u001a{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000{Y\u003E\\u001a{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000{Y\u003E\\u001a{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022534110b445e1e430dc9b641ab0056b0dfaa5a3db\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000{Y\u003E\\u001a{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd{Y\u003E{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000{Y\u003E\\u001a{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd{Y\u003E{mFL\ufffd\ufffdN\ufffd\ufffdA\ufffd\ufffd%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":6321039,"ip":"103.91.170.110","ts":"2026-10-22 02:27:21.000000","proto":"tcp","src_port":63887,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.595911055699551, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 150823, \u0022country\u0022: \u0022VN\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022VN\u0022, \u0022asn\u0022: 150823, \u0022org\u0022: \u0022FAST SOFTWARE JOINT STOCK COMPANY\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f95dcc81003bc5492fd13e5fde952ccd\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@\\u0005^%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@\\u0005^%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@\\u0005^%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@\\u0005^%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@\\u0005^%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cd7e59b693d2ed82df66124a43730c90d81cb64b\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@\\u0005^%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@^%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b\\u0012R\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\ufffd\\u0000\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@\\u0005^%\ufffd\\u0010\ufffds\ufffdI@\ufffd\ufffd\\u0014Q\\u0019\ufffd\\u0012f\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffdR\ufffd\\n9\ufffd%\u0550xM\ufffd\ufffd*\ufffd\ufffd@^%\ufffd\ufffds\ufffdI@\ufffd\ufffdQ\ufffdf\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94}],"total_events":2735}