|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b82edc85ccfccb9933b235c8b96d99fe50ee52d8",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b11bc219b591099b0a1a6e80e802aa5710814d8",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b82edc85ccfccb9933b235c8b96d99fe50ee52d8",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b11bc219b591099b0a1a6e80e802aa5710814d8",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1b5274bcdfdb9dd2dc06bbc4c62acae0466636e8",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9256d22bf479db78f509b4416fbba50a9b1b8a2d",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b82edc85ccfccb9933b235c8b96d99fe50ee52d8",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b11bc219b591099b0a1a6e80e802aa5710814d8",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1b5274bcdfdb9dd2dc06bbc4c62acae0466636e8",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9256d22bf479db78f509b4416fbba50a9b1b8a2d",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b82edc85ccfccb9933b235c8b96d99fe50ee52d8",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b11bc219b591099b0a1a6e80e802aa5710814d8",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1b5274bcdfdb9dd2dc06bbc4c62acae0466636e8",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9256d22bf479db78f509b4416fbba50a9b1b8a2d",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_bruteforce_burst",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "584dc8ab43572550a5af46f03637ac724e8c86c3",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6fe8c5a02da69a84ddf14cf3e5f6b110e80c9dbe",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_mssql_tds"
]
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "Reliance Jio Infocomm Limited",
"service": "mssql",
"app_proto": "mssql",
"asn": 55836,
"country": "IN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "584dc8ab43572550a5af46f03637ac724e8c86c3",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 55836,
"org": "Reliance Jio Infocomm Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8abfd105156edc1ee122775f11b635",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd4\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6fe8c5a02da69a84ddf14cf3e5f6b110e80c9dbe",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_mssql_tds"
]
}
|