12/10/2026 15:36:47 UTC
TCP
990 · FTPS
Sonde FTPS
ftps · via FTPS:990 · (sonde / probe)
Faible
Faible · 3
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FTPS
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
990
Chemin / cible
—
Pourquoi cette classification : Type « ftps » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 3
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206674707320726561647920706f72743d3939300d0a",
"emulator_response_len": 34,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Google LLC",
"service": "ftps",
"app_proto": "ftps",
"asn": 396982,
"country": "BE",
"dst_port": 990,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 3,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "f418e31222ffd2bfc74fc751260fa6df14b08669",
"event_fingerprint": "49e9b8a21a379a15059b9fe19ea9995e5a8c24a3",
"classification_reason": "Type \u00ab ftps \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 3
},
"named_classification_skipped": false,
"service_name": "ftps",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "58dc5217b457611f677980e978ec4c60"
},
"target_context": {
"dst_port": 990,
"service": "ftps",
"service_name": "ftps",
"risk_score": 3
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d90871863f263aab426fea2f0f18e4450c33547",
"protocol_details": {
"port": 990,
"service": "ftps",
"service_label_fr": "FTPS"
},
"attack_vector": "ftps \u00b7 via FTPS:990 \u00b7 (sonde \/ probe)",
"target_port_label": "990 \u00b7 FTPS",
"emulator_service": "ftps",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ftps \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab ftps \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 3
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 3,
"risk_label": "Faible",
"service_name": "ftps",
"service_label_fr": "FTPS",
"dst_port": 990,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ftps",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 990,
"service": "ftps",
"service_label_fr": "FTPS"
},
"attack_vector": "ftps \u00b7 via FTPS:990 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "990 \u00b7 FTPS",
"emulator_service": "ftps",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ftps",
"service_banner": "honeypot-ftps",
"service_os": "linux",
"dst_port": "990"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
12/10/2026 14:47:45 UTC
TCP
9163 · HTTP
Sonde port 9163/TCP
port 9163 tcp · via HTTP:9163 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.34.2
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9163
Chemin / cible
/
Preuve honeypot — Sonde port 9163/TCP
Connexion détectée sur le port 9163 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9163_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9163
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9163 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "2892b629ca4c11b34d6dc60609d23226faed4f38",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.113751358065142,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 9163,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "6aa1523cb2f2179cc0d60f1025e2f31d7d510ede",
"event_fingerprint": "40772da3f20ddc94d68ea83b113a5ceec043f80b",
"classification_reason": "Type \u00ab port_9163_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "e0efc4b422e08a61dc337e763a4cb1f5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9163,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9163\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9163\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9163\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9163\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9163\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_9163_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a666a5662327f5d12fe38b2fef922fd54fab6ca1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 9163,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9163\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 9163 tcp \u00b7 via HTTP:9163 \u00b7 (sonde \/ probe)",
"target_port_label": "9163 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9163_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_9163_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9163,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 9163,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9163 tcp \u00b7 via HTTP:9163 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9163\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "9163 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9163"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:28 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �� 2 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��
2 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �� 2 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.689687849945904,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "34fd919b88d1f6f4fbe8ae634b8f72b5",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\r2\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\ufffd\r2\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\r2\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61b89696235ce05ce92641774439e0c84fab5527",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\r2\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd\r2\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\r2\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd\r2\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:27 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ��T � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��T � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ��T � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.681259208574305,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0c4bd268cc4dd9ccea9683c7c5e893fa",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u0003\ufffd\ufffdT\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u0003\ufffd\ufffdT\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u0003\ufffd\ufffdT\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e4301a8ce2d026a5b93a25f660754d723f23181",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0003\ufffd\ufffdT\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffdT\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0003\ufffd\ufffdT\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffdT\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:27 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �̴ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �̴ � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �̴ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.693640588034274,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3e15a38495e8d4ce60fa2fa2df8f0820",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0334\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\u0334\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0334\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be03163ffb986dc03199c940248fb9a0ae585b2d",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0334\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\u0334\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0334\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\u0334\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:26 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; � � � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; � � � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; � � � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b98844e2b39926d550c7a31b5a816662",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u001f\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\u001f\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u001f\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6c93c6f3edd37faa8f8c3bf54da9e364097c0bfc",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u001f\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u001f\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:26 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �y. � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �y. � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �y. � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.674799100943069,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "60804948dbb8d5a63d9bf159eabe3979",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffdy.\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffdy.\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffdy.\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c5e9ef4750062f5cde32bf13797ac6bade233c0",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdy.\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffdy.\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdy.\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffdy.\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:25 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; \'�K � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; \'�K � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; \'�K � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "728ec2fbb525cc6dfb8f85d83f28ea26",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\\'\ufffdK\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\\'\ufffdK\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\\'\ufffdK\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16e0bccc72f20366c3f1970c52520c6cfc964b77",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\\'\ufffdK\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\\'\ufffdK\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\\'\ufffdK\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\\'\ufffdK\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 2,
"behavior_priority": 72
}
11/10/2026 12:34:25 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; c��g � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; c��g � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; c��g � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.673486570429204,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c12df59a5222f502e26bea5c651db91f",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000c\ufffd\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000c\ufffd\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000c\ufffd\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a8cd0431bea7d47d83357b6ea5831afa0ab15ab",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000c\ufffd\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";c\ufffd\ufffdg\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000c\ufffd\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";c\ufffd\ufffdg\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:24 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �?RU � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �?RU � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �?RU � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c9cf2b02d2cd6371434372bc7e58bc63",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd?RU\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd?RU\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd?RU\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5dd5cb58393a6ec252006875f9894175b7ff72f",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd?RU\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd?RU\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd?RU\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd?RU\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:23 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ��[ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��[ � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ��[ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.693640588034273,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "87d40bc89d73e5933e75d9ea1ff15c2e",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0005\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\u0005\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0005\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "194f2be63290b1fbfe0d2f88c6f8b2301c9648ba",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0005\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd[\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0005\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd[\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:23 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; l�? � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; l�? � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; l�? � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.6876084149235115,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a201ad14cc807439042899d035b3740",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000l\ufffd\u001b?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000l\ufffd\u001b?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000l\ufffd\u001b?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "829dc592620bd8bfb19c96a066ddfa6556173b7d",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000l\ufffd\u001b?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";l\ufffd?\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000l\ufffd\u001b?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";l\ufffd?\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:22 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; � � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
Mongo isMaster legacy
Mongo ismaster command
ET H.323 setup
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; � � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; � � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.6876084149235115,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0868",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"Mongo isMaster legacy",
"Mongo ismaster command",
"ET H.323 setup",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0868",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f813c11ebc1db663474c9cb26870ef86",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u001a\u000e\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u001a\u000e\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u001a\u000e\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6e68456480b79a2c8db11bded53ba3dff3a7a7a",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u001a\u000e\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u001a\u000e\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:22 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �GY* � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �GY* � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �GY* � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "38c4314bb114703280c47770bbdc00f8",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffdGY*\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffdGY*\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffdGY*\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "913c36a2ef4095fc561f78cda0a75894fc44d7a1",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdGY*\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffdGY*\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdGY*\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffdGY*\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:21 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "80fd657813cb0511de2b82334a307aa8",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u000f\ufffd\u001a\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\u000f\ufffd\u001a\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u000f\ufffd\u001a\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4dfcdf58c755e4db763a2d3a5f4a4b16ce9e7cda",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u000f\ufffd\u001a\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u000f\ufffd\u001a\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:21 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ϋX � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ϋX � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ϋX � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.6747754020393195,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1a144611db24e6ffb7aefaada229451b",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u0000\u03cbX\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u0000\u03cbX\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u0000\u03cbX\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b9119081563191e9d6577c520625dec37cce26a",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0000\u03cbX\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\u03cbX\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0000\u03cbX\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\u03cbX\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:20 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; z��o � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; z��o � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; z��o � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.684225342943342,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba7b350a2894ee4b1741c0b7b8d0e8",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000z\ufffd\ufffdo\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000z\ufffd\ufffdo\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000z\ufffd\ufffdo\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d66f0e69b1b6c2d5e030e4be7dfd0ee02797fe85",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000z\ufffd\ufffdo\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";z\ufffd\ufffdo\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000z\ufffd\ufffdo\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";z\ufffd\ufffdo\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:20 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ���4 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ���4 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ���4 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.689687849945904,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8d201834585de211b5fed6b52a99b6a5",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd4\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd4\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd4\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e9d0adaf0457230db9c93781c3e4a9bded88108",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd4\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd\ufffd4\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd4\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd\ufffd4\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:19 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �Ȓ} � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �Ȓ} � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �Ȓ} � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1b0e5aaa800936db93f19fa678089b70",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0212}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\u0212}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0212}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf2b97b65ceada291c96ea0251bc138577080a7d",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0212}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\u0212}\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0212}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\u0212}\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:18 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; cVf � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; cVf � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; cVf � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.665057929057606,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fd26a6d8396280178bcf50ef7bd8dd94",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u0003cVf\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u0003cVf\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u0003cVf\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee25182780048a98d941dd8fdae7b5413649a977",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0003cVf\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";cVf\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0003cVf\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";cVf\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:18 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ��� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ��� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.688530618274156,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2a4cb8019e11cde4e0ef8049a039a8a4",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6c4eb586a8166f1523ef765ff121dc20c50383a6",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:17 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; N�| � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; N�| � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; N�| � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.693640588034273,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c8864cff31613bc9fa107353845cb1ae",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000N\ufffd|\f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000N\ufffd|\f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000N\ufffd|\f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aee09dc18c2a4d05acaae04a952dbe1be92f9290",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000N\ufffd|\f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";N\ufffd|\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000N\ufffd|\f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";N\ufffd|\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:17 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �$ 0 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �$ 0 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �$ 0 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.687291381685068,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "711719fed2492d91f12b5e29d47eb4c1",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd$\u001f0\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd$\u001f0\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd$\u001f0\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "848044336b4bc7fc29451183bbc055dc4defa962",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd$\u001f0\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd$0\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd$\u001f0\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd$0\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:16 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �Y , � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �Y , � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �Y , � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.693640588034274,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ecb3f306e49dedb40d3c3470e45b3d52",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffdY\u000b,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffdY\u000b,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffdY\u000b,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "435fe1a46ce29108c57dca7ab90b13ee3567d474",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdY\u000b,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffdY,\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdY\u000b,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffdY,\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:16 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; Kt� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
Mongo isMaster legacy
Mongo ismaster command
ET H.323 setup
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; Kt� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; Kt� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.671843963483373,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0868",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"Mongo isMaster legacy",
"Mongo ismaster command",
"ET H.323 setup",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0868",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b3d2002d83a1588d11b7ae6afc2512b2",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000Kt\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000Kt\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000Kt\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "770d34f796fee1561f409de6900865d5a3861704",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000Kt\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";Kt\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000Kt\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";Kt\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:15 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; z� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; z� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; z� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d2ed209f70253e05a2701ba36a58c299",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u001az\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u001az\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u001az\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ae5815551aa588414a0cde846bf6a905d744f6d",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u001az\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";z\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u001az\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";z\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:15 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �i9 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �i9 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �i9 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.684225342943341,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "590d229b17278dd64fe4a6aa48ec938c",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffdi9\u000e\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffdi9\u000e\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffdi9\u000e\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8355339ba4e91ea9e26b14f44326a0a5e2195d9d",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdi9\u000e\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffdi9\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdi9\u000e\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffdi9\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:14 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; }l� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; }l� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; }l� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.6876084149235115,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "49f879e796833cf03c42b3001765c043",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000}l\ufffd\u001d\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000}l\ufffd\u001d\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000}l\ufffd\u001d\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6223f5ec1b27ae1f31b0124fddda938c8735fde9",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000}l\ufffd\u001d\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";}l\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000}l\ufffd\u001d\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";}l\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:13 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; )|e= � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; )|e= � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; )|e= � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.675952392082826,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5d374896a4f77ebffd6b616c76e500a",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000)|e=\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000)|e=\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000)|e=\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "006ffecd62a3d8d49a065de4596771facf79b7bf",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000)|e=\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";)|e=\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000)|e=\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";)|e=\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:13 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �2�i � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �2�i � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �2�i � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.6739233985057655,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "966134d44cab7dc0abaa8297d44f640f",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd2\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd2\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd2\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e668aed83b61b5c224dede8324d17c1a9de29b40",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd2\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd2\ufffdi\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd2\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd2\ufffdi\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:11 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �G: � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �G: � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �G: � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.685610984818461,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3d97bd520fe9892d45529fc0f6355c7a",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u0002\ufffdG:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u0002\ufffdG:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u0002\ufffdG:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54a5ebd0f7112fdfbec0959ac401dc03dae72ca9",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0002\ufffdG:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffdG:\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0002\ufffdG:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffdG:\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:11 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �v�u � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �v�u � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �v�u � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.677071442164834,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b9ef77460174220f46f55cd23509717",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffdv\ufffdu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffdv\ufffdu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffdv\ufffdu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c0419c291109de618b3f87a280ebd665843580f1",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdv\ufffdu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffdv\ufffdu\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffdv\ufffdu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffdv\ufffdu\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:10 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; FJn � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; FJn � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; FJn � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.682857600523568,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8ce3430f820a1925f03cf862c59b4f06",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000FJ\u001an\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000FJ\u001an\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000FJ\u001an\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7be7116ae874b092db38087ff959d21ef39c08d2",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000FJ\u001an\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";FJn\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000FJ\u001an\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";FJn\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:10 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; Ee?Y � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; Ee?Y � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; Ee?Y � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.682301598432033,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a34ae487b8cda80dc99894cb7e97494b",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000Ee?Y\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000Ee?Y\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000Ee?Y\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64c20ff72daa79ee6d87a0e23a8a4fe72707a8aa",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000Ee?Y\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";Ee?Y\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000Ee?Y\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";Ee?Y\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:09 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ��lu � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��lu � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ��lu � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.6761492388141885,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9356e9b9a00e1e5f4f09810019ba85ef",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffdlu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\ufffdlu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffdlu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c013e5b920d1f21a8734a8f42b369ddb369a94cd",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffdlu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffdlu\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffdlu\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffdlu\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:09 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ��? � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��? � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ��? � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ac13b84095e04a6eceb79ebe0045f26",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u0013\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u0013\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u0013\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0490c5ebbc55497e4f4b721d203cef82b05950de",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0013\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd?\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0013\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd?\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:08 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �jV � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �jV � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �jV � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.691244119773437,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b00d56ef1efc2637fa70ee0728f57c1",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0006jV\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\u0006jV\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\u0006jV\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b83b06395fb6e76b93c1395c11e3c04788302a6",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0006jV\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffdjV\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\u0006jV\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffdjV\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:07 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; O#�: � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; O#�: � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; O#�: � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.693640588034273,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6b296522bd3e1e2a2ed3053379c8552b",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000O#\ufffd:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000O#\ufffd:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000O#\ufffd:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf035082e5d33409c886044db84ab8786679d980",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000O#\ufffd:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";O#\ufffd:\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000O#\ufffd:\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";O#\ufffd:\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
11/10/2026 12:34:07 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; c?W5 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; c?W5 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; c?W5 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.679835776778411,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9510c9b53ef5b6fa39311554701614f3",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000c?W5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000c?W5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000c?W5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7ccd416b83eda48812befef378576162eb2972d7",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000c?W5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";c?W5\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000c?W5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";c?W5\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:06 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ��c � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��c � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ��c � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.686184983127617,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "65047dc67bc0df9ebe539a903555b402",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffdc\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\ufffdc\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffdc\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "435892b2b942ef73171f2607957ab91f1c804601",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffdc\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffdc\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffdc\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffdc\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:06 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ���L � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ���L � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ���L � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.691244119773437,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f6f513ecab068f4d13a776d6bebf3ff",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\ufffdL\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\ufffd\ufffdL\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd\ufffdL\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4628720286e19875f59259f5f8b01430fe772c3",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\ufffdL\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd\ufffdL\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd\ufffdL\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd\ufffdL\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:05 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; ��{ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; ��{ � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; ��{ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4852763dbb0fec4513f71ee9d2623c0a",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd{\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\ufffd\ufffd{\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\ufffd\ufffd{\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "640a50dda25643350399a096b8be424a7148acb0",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd{\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd\ufffd{\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\ufffd\ufffd{\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd\ufffd{\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:05 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �_ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �_ � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �_ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.693640588034274,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c58fd16dda1653106b7ccb9a36ced574",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u0004\ufffd_\u0019\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u0004\ufffd_\u0019\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u0004\ufffd_\u0019\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c9cea18525e43707fa8bbde8296294cd09dc4e2",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0004\ufffd_\u0019\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\ufffd_\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u0004\ufffd_\u0019\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\ufffd_\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:04 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; +|�g � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; +|�g � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; +|�g � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.680942175335861,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "08c42c0579a7c0b9f35f9906098c8d16",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000+|\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000+|\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000+|\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "591e7ad62c6b19e51abe7edb4d4c3999fa3db21b",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000+|\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";+|\ufffdg\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000+|\ufffdg\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";+|\ufffdg\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:04 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; i��[ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; i��[ � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; i��[ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.684225342943341,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dee2ff7656c2d5875095e62200e09d09",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000i\ufffd\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000i\ufffd\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000i\ufffd\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf1568f72362b6c7d6188c847e7e65996a64b70b",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000i\ufffd\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";i\ufffd\ufffd[\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000i\ufffd\ufffd[\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";i\ufffd\ufffd[\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:03 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; �5 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; �5 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; �5 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.680942175335861,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "67a5ae09dba822f37ccbd1fe28ea72a9",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\t\u0014\ufffd5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\t\u0014\ufffd5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\t\u0014\ufffd5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08c69f7bdc4b508734bad6c5e8d71877ab6c937a",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\t\u0014\ufffd5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";\t\ufffd5\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\t\u0014\ufffd5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";\t\ufffd5\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:02 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; 0̮ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; 0̮ � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; 0̮ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.683338643596698,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cf49c7b3c1bcd7916bcd58c097979853c972afbc",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a369d012175b79084cf6686723233443",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u00000\u032e\u0007\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u00000\u032e\u0007\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u00000\u032e\u0007\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c05eb32d6da1290a456564a0fb1a16112d90365a",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u00000\u032e\u0007\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";0\u032e\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u00000\u032e\u0007\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";0\u032e\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:02 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_mongodb_wire_protocol
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; 8� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; 8�
� admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; 8� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.670516103859212,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3c2e27c9d6c283412a15420af64a6448b5c64212",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "388e89c93331e46e743cf30c3b23dc3d",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000\u00028\ufffd\n\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000\u00028\ufffd\n\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000\u00028\ufffd\n\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f2c5e443cdb5adda7e9890d87c3d593704313d5",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u00028\ufffd\n\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";8\ufffd\n\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000\u00028\ufffd\n\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";8\ufffd\n\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:01 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_mongodb_wire_protocol
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; L�� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; L�� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; L�� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.679784943664114,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3c2e27c9d6c283412a15420af64a6448b5c64212",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bcec42ca62aefb733890f99d511932b6",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000L\ufffd\ufffd\u0001\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000L\ufffd\ufffd\u0001\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000L\ufffd\ufffd\u0001\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e355c6f20fe3e2d3acc2a21d57e3ee7a85adbecd",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000L\ufffd\ufffd\u0001\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";L\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000L\ufffd\ufffd\u0001\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";L\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}
11/10/2026 12:34:01 UTC
TCP
27017 · MONGODB
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_mongodb_wire_protocol
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
; <�� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
ET-PROTO-MongoDB-Wire
pat-0363
pat-0364
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
; <�� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
; <�� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.85+ platform CPython 3.13.14.final.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 315,
"payload_entropy": 4.699989794383479,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3c2e27c9d6c283412a15420af64a6448b5c64212",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "195ea181ba2e3200f86fc15d9c231263",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 38
},
"payload_snippet": ";\u0001\u0000\u0000<\ufffd\ufffd\u0011\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ";\u0001\u0000\u0000<\ufffd\ufffd\u0011\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.",
"payload_snippet": ";\u0001\u0000\u0000<\ufffd\ufffd\u0011\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab533b969ce74bf6ef9fcc91ad156a8982fdd803",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000<\ufffd\ufffd\u0011\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": ";<\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": ";\u0001\u0000\u0000<\ufffd\ufffd\u0011\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";<\ufffd\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffdismasterhelloOkclient\ufffddriver-name\nPyMongo|cversion4.13",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_mongodb_wire_protocol"
],
"asn_dc_heuristic": true
}