Détails IP 158.106.204.166

Synthèse exécutive

Profil de menace

Score de risque 52/100 Moyen

Première observation 17/06/2026 18:11 UTC

Dernière observation 17/06/2026 20:49 UTC

Événements (période) 636

MITRE ATT&CK principal TA0007 507 occurrences

Activité suspecte · risque 38/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8

Comparaison ASN / FAI

ASN 46450 · 158.106.192.0/19 · ARIN · 636 événements sur la période pour cette IP.

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

MSMQ TCP 213 JETDIRECT TCP 203 EPMD TCP 200 WEBLOGIC TCP 12 HTTP TCP 8

MSMQ

213

JETDIRECT

203

EPMD

200

WEBLOGIC

HTTP

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

636 événement(s) — page 1/13

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
17/06/2026 20:49:21 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0b2e0c58f56e9ee8c23c01e1fef06198", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a374a2783fce737ae61755b8dced4a4b3d396ba4", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:21 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload �!�admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �!�admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) �!�admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "50e624ea0d0076b318258113b57916dd", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5ab5db9f2430bbb3ed592d9e7b75347aee366a03", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd!\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd!\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde montage NFS nfs mount · via JETDIRECT:9100 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload �(NFS0�� Pourquoi cette classification : Type « nfs_mount » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0379 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) NFS mount string NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(NFS0�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 44, "payload_entropy": 1.6761360291184577, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "6deae0c7c1a050bba0c537a2b25fc818a7da24b5", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0379" ], "kb_rule_ids": [ "pat-0379" ], "matched_patterns": [ "pat-0379", "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS mount string", "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0379", "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "61a5832a37fd30843e8cf24483a0605f", "path_pattern_hash": "38dfb4397d753d5c3c57b50e7f57234c" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 45 }, "payload_preview": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d638bf77a0b34519812a54162ee0dd1911158cb4", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd(NFS0\ufffd\ufffd", "attack_vector": "nfs mount \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0379" ], "tags_summary_labels_fr": [ "pat-0379" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "nfs mount \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd(NFS0\ufffd\ufffd", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload c Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) c Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 24, "payload_entropy": 0.24988229283318544, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d98b4c95d89a83c72b8b3ef5e42fc38c", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "046d5fe954241605691f465e310b5b1253832b1d", "protocol_details": { "payload_preview": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "c", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "c", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a5041c4c237adb2767e90f123d0d04c9", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0abd23aaaa1b4e38da5206ba1755b4a501fea380", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload 1 $4 PING Pourquoi cette classification :* Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Redis PING RESP User-Agent — Règles WAF — Payload (extrait) 1 $4 PING Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 14, "payload_entropy": 3.128085278891395, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0414" ], "matched_pattern_names": [ "Redis PING RESP" ], "pattern_ids": [ "pat-0414" ], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a43cb6a3b9d261112714d00e36b33106", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "1\r\n$4\r\nPING\r\n", "request_sample": "1\r\n$4\r\nPING\r\n", "payload_snippet": "1\r\n$4\r\nPING", "evidence": { "request_sample": "1\r\n$4\r\nPING\r\n", "payload_snippet": "1\r\n$4\r\nPING", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2f6e02e9c4f142e27195a041b3011c0ddd6b0983", "protocol_details": { "payload_preview": "1\r\n$4\r\nPING", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "1\r\n$4\r\nPING", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "1\r\n$4\r\nPING", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "1\r\n$4\r\nPING", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload 1 $4 INFO Pourquoi cette classification :* Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Redis INFO User-Agent — Règles WAF — Payload (extrait) 1 $4 INFO Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 14, "payload_entropy": 3.128085278891395, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0411" ], "matched_pattern_names": [ "Redis INFO" ], "pattern_ids": [ "pat-0411" ], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f97ce549efeee853d655f0c9276962a8", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "1\r\n$4\r\nINFO\r\n", "request_sample": "1\r\n$4\r\nINFO\r\n", "payload_snippet": "1\r\n$4\r\nINFO", "evidence": { "request_sample": "1\r\n$4\r\nINFO\r\n", "payload_snippet": "1\r\n$4\r\nINFO", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "90fdd532dd7199cacc76473c818b1adeb251b8f6", "protocol_details": { "payload_preview": "1\r\n$4\r\nINFO", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "1\r\n$4\r\nINFO", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "1\r\n$4\r\nINFO", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "1\r\n$4\r\nINFO", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0c02e500fca406a185fa2b1942359dc9", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "84a721876a512c5ba6083148b0490195b5ff2e16", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde port 9100/TCP port 9100 tcp · via JETDIRECT:9100 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags net_redis_probe redis_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Preuve honeypot — Sonde port 9100/TCP Connexion détectée sur le port 9100 (TCP) du capteur simulé. Service JETDIRECT Payload PING Pourquoi cette classification : Type « port_9100_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) PING Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 6, "payload_entropy": 2.584962500721156, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 40, "tag_count": 2, "anomaly_count": 0, "campaign_key": "35e9e7d509f3f94125f208bbf1d8060d9d0f79ce", "event_fingerprint": "d4e30af239d63ea76bb2fd131a90c69dc07660a0", "classification_reason": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 40 }, "named_classification_skipped": true, "named_candidate": "redis_probe", "service_name": "jetdirect", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dedee95a5c3354a76fa11ee26963cbe7", "path_pattern_hash": "1144138c1a57dd6566e67742399f5aa8" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 40 }, "payload_preview": "PING\r\n", "request_sample": "PING\r\n", "payload_snippet": "PING", "evidence": { "request_sample": "PING\r\n", "payload_snippet": "PING", "classification_reason": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fe81863755b987249169338e93006b9368df0ae", "protocol_details": { "payload_preview": "PING", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "PING", "attack_vector": "port 9100 tcp \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "PING", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "port 9100 tcp \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "PING", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_redis_probe", "redis_probe" ] }
17/06/2026 20:49:20 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99a5882356b4d78fbb128d9a01d6cf13e652995b", "protocol_details": { "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	amqp probe amqp probe · via JETDIRECT:9100 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Investiguer Tags amqp_handshake net_amqp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload AMQP Pourquoi cette classification : Type « amqp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Proto Amqp Auth pat-0371 pat-0537 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) AMQP protocol AMQP protocol header User-Agent — Règles WAF — Payload (extrait) AMQP Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 8, "payload_entropy": 2.75, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 43, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 43, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 50, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4d3bf7d8f5641d79de81b5db16b03960d7757ef3", "event_fingerprint": "1ad055820766351a2df61f205476b8da7cdaa169", "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 199, "precision_signals": [ "INT-PROTO-amqp-auth", "pat-0371", "pat-0537", "INT-upstream" ], "kb_rule_ids": [ "INT-PROTO-amqp-auth", "pat-0371", "pat-0537", "INT-upstream" ], "matched_patterns": [ "pat-0371", "pat-0537" ], "matched_pattern_names": [ "AMQP protocol", "AMQP protocol header" ], "pattern_ids": [ "pat-0371", "pat-0537" ], "confidence_breakdown": { "waf": 8, "classification": 43, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bc2f502576523902588d3c36f36ea5a1", "path_pattern_hash": "e0a8a2707ca9342b66a175c0e4383ba0" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 50 }, "payload_preview": "AMQP\u0000\u0000\t\u0001", "request_sample": "AMQP\u0000\u0000\t\u0001", "payload_snippet": "AMQP\u0000\u0000\t\u0001", "evidence": { "request_sample": "AMQP\u0000\u0000\t\u0001", "payload_snippet": "AMQP\u0000\u0000\t\u0001", "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e222789821bd5252c0211a51b1b3c125b3932209", "protocol_details": { "payload_preview": "AMQP\u0000\u0000\t\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "AMQP", "attack_vector": "amqp probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via JETDIRECT", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 43, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "INT-PROTO-amqp-auth", "pat-0371", "pat-0537", "INT-upstream" ], "tags_summary_labels_fr": [ "Proto Amqp Auth", "pat-0371", "pat-0537", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "AMQP\u0000\u0000\t\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "amqp probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "AMQP", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "amqp_handshake", "net_amqp_probe" ] }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	Cross-site scripting xss attack · via JETDIRECT:9100 · (tentative d'exploit)	Faible	Faible · 39
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload <?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' versio Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Faible · 39 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 LFI Double-dot bypass XMPP stream User-Agent — Règles WAF — Payload (extrait) <?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' versio Requête brute (extrait) <?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'> Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 136, "payload_entropy": 4.7035497892369795, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15 }, "risk_score": 39, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0103", "pat-0530" ], "matched_pattern_names": [ "CRS 941130", "LFI Double-dot bypass", "XMPP stream" ], "pattern_ids": [ "pat-0284", "pat-0103", "pat-0530" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 39 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4c1af05024003e93f859eb8590dac59c", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 39 }, "payload_preview": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio", "request_sample": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' version='1.0'>", "payload_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio", "evidence": { "request_sample": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' version='1.0'>", "payload_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b91a353554f129c4743342cf12e6626a52c0a29e", "protocol_details": { "payload_preview": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio", "attack_vector": "xss attack \u00b7 via JETDIRECT:9100 \u00b7 (tentative d'exploit)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via JETDIRECT", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 39 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 39, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "xss attack \u00b7 via JETDIRECT:9100 \u00b7 (tentative d'exploit)", "evidence_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "behavior_alert_count": 1, "behavior_priority": 96 }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b01512d56868747ce8dc803ed3976d26", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "93641b07aab2f0a4e88b50b18917b0db5b6583f7", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde SMB smb probe · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload j3X Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0354 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SMB negotiate Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) j3X Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 28, "payload_entropy": 1.5131168549735339, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0354" ], "kb_rule_ids": [ "pat-0354" ], "matched_patterns": [ "pat-0354", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "SMB negotiate", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0354", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e6fcd6c090da73956becab3e413ee257", "path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000\u0001j3\bX\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004", "request_sample": "\u0000\u0000\u0000\u0001j3\bX\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004", "payload_snippet": "\u0000\u0000\u0000\u0001j3\bX\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004", "evidence": { "request_sample": "\u0000\u0000\u0000\u0001j3\bX\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004", "payload_snippet": "\u0000\u0000\u0000\u0001j3\bX\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004", "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4e7765638866a9f1f6e0225ac74849bd465aa3dc", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001j3\bX\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "j3X", "attack_vector": "smb probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0354" ], "tags_summary_labels_fr": [ "pat-0354" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001j3\bX\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "smb probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "j3X", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload >2!'�� Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) >2!'�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 38, "payload_entropy": 2.3985082772637103, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "21164128a00223274f8c6e16f6f9b38a", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0000\u0000 \u0000\u0000\u0000>\u00032!\u0001\u0001\u0010'\u0001\u0001\u0001\u0001\u0001\u0001\ufffd\ufffd\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000", "request_sample": "\u0000\u0000 \u0000\u0000\u0000>\u00032!\u0001\u0001\u0010'\u0001\u0001\u0001\u0001\u0001\u0001\ufffd\ufffd\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000 \u0000\u0000\u0000>\u00032!\u0001\u0001\u0010'\u0001\u0001\u0001\u0001\u0001\u0001\ufffd\ufffd\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000 \u0000\u0000\u0000>\u00032!\u0001\u0001\u0010'\u0001\u0001\u0001\u0001\u0001\u0001\ufffd\ufffd\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000 \u0000\u0000\u0000>\u00032!\u0001\u0001\u0010'\u0001\u0001\u0001\u0001\u0001\u0001\ufffd\ufffd\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c2b0262d5a5146c1659d55c0b786fb694b1257fb", "protocol_details": { "payload_preview": "\u0000\u0000 \u0000\u0000\u0000>\u00032!\u0001\u0001\u0010'\u0001\u0001\u0001\u0001\u0001\u0001\ufffd\ufffd\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": ">2!'\ufffd\ufffd", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0000 \u0000\u0000\u0000>\u00032!\u0001\u0001\u0010'\u0001\u0001\u0001\u0001\u0001\u0001\ufffd\ufffd\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": ">2!'\ufffd\ufffd", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 4, "payload_entropy": 0, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "df3f619804a92fdb4057192dc43dd748", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "166075da017f072aadc51702daa9fb7fe8838255", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload n Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) n Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "76fae3c085bb43bf34b254b13bd8d00d", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0000\u0001n", "request_sample": "\u0000\u0001n", "payload_snippet": "\u0000\u0001n", "evidence": { "request_sample": "\u0000\u0001n", "payload_snippet": "\u0000\u0001n", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "936f91d6c2764765b0aff57fbf0c580a95483c05", "protocol_details": { "payload_preview": "\u0000\u0001n", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "n", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0001n", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "n", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde montage NFS nfs mount · via JETDIRECT:9100 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload �(NFS0�� Pourquoi cette classification : Type « nfs_mount » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0379 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header NFS mount string ET H.323 setup NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(NFS0�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 44, "payload_entropy": 1.6761360291184577, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "6deae0c7c1a050bba0c537a2b25fc818a7da24b5", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0379" ], "kb_rule_ids": [ "pat-0379" ], "matched_patterns": [ "pat-0348", "pat-0379", "pat-0868", "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "NFS mount string", "ET H.323 setup", "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0379", "pat-0868", "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05d8460c0884d7c9182f9c7a3daeec10", "path_pattern_hash": "38dfb4397d753d5c3c57b50e7f57234c" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 45 }, "payload_preview": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "616e9ffadc907092ae56a3b77d4f2487c3983c8e", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd(NFS0\ufffd\ufffd", "attack_vector": "nfs mount \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab nfs_mount \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0379" ], "tags_summary_labels_fr": [ "pat-0379" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(NFS0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "nfs mount \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd(NFS0\ufffd\ufffd", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "30f672e1822c8268f64ac92fd4073e77", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u0019\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u0019\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u0019\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ee15a344eab28fb8db7ce20cb4cff907946d155", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0019\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0019\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:19 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload CNXN2��host:: Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) CNXN2��host:: Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 31, "payload_entropy": 3.3729205036561045, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2ab0510cc4156c41c24112bc2a720db2", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000", "request_sample": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000", "payload_snippet": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000", "evidence": { "request_sample": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000", "payload_snippet": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4c4bf8b5aa2b4dfb9f5dcb15eb9f6965668a9b3b", "protocol_details": { "payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "CNXN2\ufffd\ufffd\ufffd\ufffdhost::", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "CNXN2\ufffd\ufffd\ufffd\ufffdhost::", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde Java RMI java rmi probe · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload JRMIK Pourquoi cette classification : Type « java_rmi_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0604 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Java RMI JRMI User-Agent — Règles WAF — Payload (extrait) JRMIK Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 7, "payload_entropy": 2.807354922057604, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0604" ], "kb_rule_ids": [ "pat-0604" ], "matched_patterns": [ "pat-0604" ], "matched_pattern_names": [ "Java RMI JRMI" ], "pattern_ids": [ "pat-0604" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8c49a0f759e2102fb8fa8368049d06a", "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 32 }, "payload_preview": "JRMI\u0000\u0002K", "request_sample": "JRMI\u0000\u0002K", "payload_snippet": "JRMI\u0000\u0002K", "evidence": { "request_sample": "JRMI\u0000\u0002K", "payload_snippet": "JRMI\u0000\u0002K", "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10947dbc44638259948b8d1ccd99ba63bd6dc27f", "protocol_details": { "payload_preview": "JRMI\u0000\u0002K", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "JRMIK", "attack_vector": "java rmi probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0604" ], "tags_summary_labels_fr": [ "pat-0604" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "JRMI\u0000\u0002K", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "java rmi probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "JRMIK", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole TDS MSSQL mssql tds · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mssql_tds net_mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload 4 Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0536 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 4 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 5, "payload_entropy": 2.321928094887362, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "08ca123b90bf84c9e9d2984563eb09feee3957cd", "event_fingerprint": "c6ef6f933ac555737be56d247749df6717c772d9", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0536" ], "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "998c4c91063c53dbcdff933fad5ea02c", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 32 }, "payload_preview": "\u00124\u0000\u0001\n", "request_sample": "\u00124\u0000\u0001\n", "payload_snippet": "\u00124\u0000\u0001", "evidence": { "request_sample": "\u00124\u0000\u0001\n", "payload_snippet": "\u00124\u0000\u0001", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "49cca6f168050dc55921ceef9a33c684ac11d15a", "protocol_details": { "payload_preview": "\u00124\u0000\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "4", "attack_vector": "mssql tds \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0536" ], "tags_summary_labels_fr": [ "pat-0536" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u00124\u0000\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mssql tds \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "4", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "mssql_tds", "net_mssql_tds" ] }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags http2_preface Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload PRI * HTTP/2.0 SM Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) PRI * HTTP/2.0 SM Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 33, "payload_entropy": 3.65045472541906, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 16, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 16, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "098db2a192f38cf253c354b9432b98bacf217e3a", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 16, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 35 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da74b3e9488c0813fcd76f6273b0c115", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 35 }, "payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000", "request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "93790c5aadfd811073314389bbce9937b8789066", "protocol_details": { "payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 16, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http2_preface" ] }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload t3 12.2.1 AS:255 HL:19 MS:10000000 Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) t3 12.2.1 AS:255 HL:19 MS:10000000 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 36, "payload_entropy": 3.648511114409896, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n", "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000", "evidence": { "request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n", "payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "03d1a1d4b40b64fc9a82868e6347c510ce625f20", "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "323d54e8666ed8f5e6dc4ef6aac777ba", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0ec80b49ad899bcb6de3002221b45f678a0cb451", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload 0026git-upload-pack /host=62.3.50.33 Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 0026git-upload-pack /host=62.3.50.33 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 38, "payload_entropy": 4.4514890264306795, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cdeda6029ed66fc1799d1961e17d33df", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000", "request_sample": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000", "payload_snippet": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000", "evidence": { "request_sample": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000", "payload_snippet": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b106abf25814d122b74a4af74e54129553b1ffd2", "protocol_details": { "payload_preview": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "0026git-upload-pack \/host=62.3.50.33", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "0026git-upload-pack \/host=62.3.50.33", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload 1, 1 Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 1, 1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 6, "payload_entropy": 2.2516291673878226, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4dec1af7a5e8ffac3511945776621f67", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "1, 1\r\n", "request_sample": "1, 1\r\n", "payload_snippet": "1, 1", "evidence": { "request_sample": "1, 1\r\n", "payload_snippet": "1, 1", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ce03fecd5ddc39e2382f84c81f43ab4b62549e6", "protocol_details": { "payload_preview": "1, 1", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "1, 1", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "1, 1", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "1, 1", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 2, "payload_entropy": 1, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7eb70257593da06f682a3ddda54a9d26", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "\r\n", "request_sample": "\r\n", "evidence": { "request_sample": "\r\n", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "49e32fc5b927e53fe04ebe1f90be48dec2ebed2a", "protocol_details": { "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 16, "payload_entropy": 0.6685644431995964, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3ef30651f1b95b36f03bb51b641eaeda", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b7b18685a06c24882d959da3d1428e9eb4b2d977", "protocol_details": { "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "03b323dadcef05dca19696bce5990d11", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u0015\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u0015\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u0015\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c6c8537d681ed48792e01f2747758def5e00789f", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0015\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0015\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload example.com Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) example.com Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 13, "payload_entropy": 3.3927474104487847, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b554204323efdd0397c86823d443ca92", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "example.com\r\n", "request_sample": "example.com\r\n", "payload_snippet": "example.com", "evidence": { "request_sample": "example.com\r\n", "payload_snippet": "example.com", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ce496ab3a73196a6b160040e97d75f5a387a136f", "protocol_details": { "payload_preview": "example.com", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "example.com", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "example.com", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "example.com", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:18 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload root Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) root Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 6, "payload_entropy": 2.2516291673878226, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b47c4c5f82a3b46964d446dca60c70bb", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "root\r\n", "request_sample": "root\r\n", "payload_snippet": "root", "evidence": { "request_sample": "root\r\n", "payload_snippet": "root", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8c90b47e98e2bd2aae2276ce9f038a8a1939bca4", "protocol_details": { "payload_preview": "root", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "root", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "root", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "root", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload P�� Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 21, "payload_entropy": 2.389758003492557, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a68e8e7f92f816f679f58e667ea7351e", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "P\u0000\u0000\ufffd\ufffd\u0003\u0000\f\u0000\u0010\u0000\u0001\u0004\u0000\u0000\u0000\u0000\u0000\ufffd\u0001\u0000", "request_sample": "P\u0000\u0000\ufffd\ufffd\u0003\u0000\f\u0000\u0010\u0000\u0001\u0004\u0000\u0000\u0000\u0000\u0000\ufffd\u0001\u0000", "payload_snippet": "P\u0000\u0000\ufffd\ufffd\u0003\u0000\f\u0000\u0010\u0000\u0001\u0004\u0000\u0000\u0000\u0000\u0000\ufffd\u0001\u0000", "evidence": { "request_sample": "P\u0000\u0000\ufffd\ufffd\u0003\u0000\f\u0000\u0010\u0000\u0001\u0004\u0000\u0000\u0000\u0000\u0000\ufffd\u0001\u0000", "payload_snippet": "P\u0000\u0000\ufffd\ufffd\u0003\u0000\f\u0000\u0010\u0000\u0001\u0004\u0000\u0000\u0000\u0000\u0000\ufffd\u0001\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "471f72415d800a86cfacff14a67afc25a22a15fc", "protocol_details": { "payload_preview": "P\u0000\u0000\ufffd\ufffd\u0003\u0000\f\u0000\u0010\u0000\u0001\u0004\u0000\u0000\u0000\u0000\u0000\ufffd\u0001\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "P\ufffd\ufffd\ufffd", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "P\u0000\u0000\ufffd\ufffd\u0003\u0000\f\u0000\u0010\u0000\u0001\u0004\u0000\u0000\u0000\u0000\u0000\ufffd\u0001\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "P\ufffd\ufffd\ufffd", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cf217f1d9251a396b7e80094669c8cca", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "89ff4de9fc31ca6812339306d08db5a67736aca6", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload 500000FF03FF000018001004010000D0000000001 Pourquoi cette classification :* Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 500000FF03FF000018001004010000D0000000001 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 42, "payload_entropy": 1.8064617604546434, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "677dbb7235e9dcc588a2ba992e32da9e", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "500000FF03FF000018001004010000D0000000001", "request_sample": "500000FF03FF000018001004010000D0000000001", "payload_snippet": "500000FF03FF000018001004010000D0000000001", "evidence": { "request_sample": "500000FF03FF000018001004010000D0000000001", "payload_snippet": "500000FF03FF000018001004010000D0000000001", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "947497c7e52e67418dd54c6766e14df8b5b0c483", "protocol_details": { "payload_preview": "500000FF03FF000018001004010000D0000000001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "500000FF03FF000018001004010000D0000000001", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "500000FF03FF000018001004010000D0000000001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "500000FF03FF000018001004010000D0000000001", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole TDS MSSQL mssql tds · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mssql_tds net_mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload 4 Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 4 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 14, "payload_entropy": 2.0930692077718898, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "08ca123b90bf84c9e9d2984563eb09feee3957cd", "event_fingerprint": "c6ef6f933ac555737be56d247749df6717c772d9", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7d6abff7ed63a45433ab902e60248620", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 32 }, "payload_preview": "\u00124\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "request_sample": "\u00124\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "payload_snippet": "\u00124\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "evidence": { "request_sample": "\u00124\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "payload_snippet": "\u00124\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5e71348d8bce0a5819521600655c6bdc0b49a718", "protocol_details": { "payload_preview": "\u00124\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "4", "attack_vector": "mssql tds \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u00124\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mssql tds \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "4", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "mssql_tds", "net_mssql_tds" ] }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ruok Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ruok Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 4, "payload_entropy": 2, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29f8a395031b075d400c3d55eaeb0f0a", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "ruok", "request_sample": "ruok", "payload_snippet": "ruok", "evidence": { "request_sample": "ruok", "payload_snippet": "ruok", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5038c249500a5f7ea74c727f67ea8c72e080123", "protocol_details": { "payload_preview": "ruok", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "ruok", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "ruok", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "ruok", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 10, "payload_entropy": 1.9609640474436814, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d2d9a52d0437a637acfc9e48592c5dd6", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0000\u0001\u0000\u0000\u0000\u0006\u0001\f\r\u0000", "request_sample": "\u0000\u0001\u0000\u0000\u0000\u0006\u0001\f\r\u0000", "payload_snippet": "\u0000\u0001\u0000\u0000\u0000\u0006\u0001\f\r\u0000", "evidence": { "request_sample": "\u0000\u0001\u0000\u0000\u0000\u0006\u0001\f\r\u0000", "payload_snippet": "\u0000\u0001\u0000\u0000\u0000\u0006\u0001\f\r\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6401914d3a05d16bd041b15f47d4350000911116", "protocol_details": { "payload_preview": "\u0000\u0001\u0000\u0000\u0000\u0006\u0001\f\r\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0001\u0000\u0000\u0000\u0006\u0001\f\r\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde Java RMI java rmi probe · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload JRMILP��w"DM��;� Pourquoi cette classification : Type « java_rmi_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0604 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Java RMI JRMI Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) JRMILP��w"DM��;� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 48, "payload_entropy": 2.8686716140875377, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0604" ], "kb_rule_ids": [ "pat-0604" ], "matched_patterns": [ "pat-0604", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Java RMI JRMI", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0604", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c93bd009b6a661ab60139d3d599602a7", "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 32 }, "payload_preview": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd", "request_sample": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd", "payload_snippet": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd", "evidence": { "request_sample": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd", "payload_snippet": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd", "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f9627b904f13897563d778a6b8afd6e29e1f73", "protocol_details": { "payload_preview": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "JRMILP\ufffd\ufffdw\"DM\ufffd\ufffd\ufffd;\ufffd", "attack_vector": "java rmi probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0604" ], "tags_summary_labels_fr": [ "pat-0604" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "java rmi probe \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "JRMILP\ufffd\ufffdw\"DM\ufffd\ufffd\ufffd;\ufffd", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
17/06/2026 20:49:17 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b4fba9b301d4a96c3bb5f846f9d7b9c", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u0011\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u0011\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u0011\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "593b01e1669cf3c27864aff96e3fed9ca0392cc3", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0011\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u0011\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a9b6846df7c6ebb575095747dbd2466e", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "request_sample": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7854645d64a813f009af7c669d7a68999e1b60e7", "protocol_details": { "payload_preview": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload /00GF01 Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) /00GF01 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 8, "payload_entropy": 2.4056390622295662, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "jetdirect", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b4d8ea061ded7b1c2bf35f35eac7a3fe", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 0 }, "payload_preview": "\/00GF01\r", "request_sample": "\/00GF01\r", "payload_snippet": "\/00GF01", "evidence": { "request_sample": "\/00GF01\r", "payload_snippet": "\/00GF01", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7fb23700533992e74d60027b9d65babefb992cc", "protocol_details": { "payload_preview": "\/00GF01", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\/00GF01", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\/00GF01", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\/00GF01", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "behavior_alert_count": 2, "behavior_priority": 72 }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload NICK networkscanfp USER networkscanfp 0 * :networkscan Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0529 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) NICK networkscanfp USER networkscanfp 0 * :networkscan Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 57, "payload_entropy": 4.465988207178161, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0529" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0404b7509e014c4edc31542d095f75d3", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan\r\n", "request_sample": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan\r\n", "payload_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan", "evidence": { "request_sample": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan\r\n", "payload_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b92d8b3a1ae46803cdeab4615980aa5cb3c6581d", "protocol_details": { "payload_preview": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0529" ], "tags_summary_labels_fr": [ "pat-0529" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde port 9100/TCP port 9100 tcp · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Preuve honeypot — Sonde port 9100/TCP Connexion détectée sur le port 9100 (TCP) du capteur simulé. Service JETDIRECT Payload Pourquoi cette classification : Type « port_9100_tcp » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header ET H.323 setup Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 35, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_reason": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0348" ], "kb_rule_ids": [ "pat-0348" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 35 }, "named_classification_skipped": true, "named_candidate": "rdp_probe", "service_name": "jetdirect", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "93f1c4418cec9ea1e95227d4493b77a7", "path_pattern_hash": "1144138c1a57dd6566e67742399f5aa8" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 35 }, "payload_preview": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "18fe89d2e9edc4172881336f98acca6476bd9e5f", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "port 9100 tcp \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab port_9100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0348" ], "tags_summary_labels_fr": [ "pat-0348" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "port 9100 tcp \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 14, "payload_entropy": 1.626688849701832, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a6935157cd6b9eac86a84be5d0ee2195", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0000\u0001\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "request_sample": "\u0000\u0001\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "payload_snippet": "\u0000\u0001\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "evidence": { "request_sample": "\u0000\u0001\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "payload_snippet": "\u0000\u0001\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "92b87b1705116107791d3c03501f64b7d39d290c", "protocol_details": { "payload_preview": "\u0000\u0001\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0001\u0000\u0000\u0000\b\u0001\f\u0000\u0000\u0000\u0000\r\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload fox Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) fox Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 12, "payload_entropy": 2.4508257945180887, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f458fc12afe2c6bda83796bf902e8408", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001", "request_sample": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001", "payload_snippet": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001", "payload_snippet": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4b93002ffe0c7894ad8a00b2a1c4d3b89a0c6630", "protocol_details": { "payload_preview": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "fox", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "fox", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	Protocole wire MongoDB mongodb wire protocol · via JETDIRECT:9100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags mongodb_hello_probe net_mongodb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload � �admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0363 pat-0364 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Mongo isMaster legacy Mongo ismaster command NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go- Requête brute (extrait) � �admin.$cmd��isMasterhelloOkcompressionclient�driver3namemongo-go-driverversion1.17.4os.typedarwinarchitecturearm64platform go1.26.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 231, "payload_entropy": 4.369460772401425, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dc2ec784f9a815f823c3fd671e6643654e6864ac", "event_fingerprint": "c4ffac262af74aac6212858329eccfdbb04aa9c9", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0363", "pat-0364" ], "kb_rule_ids": [ "pat-0363", "pat-0364" ], "matched_patterns": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Mongo isMaster legacy", "Mongo ismaster command", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0363", "pat-0364", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "jetdirect", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ad44bf19ea2ce10a5c567ffedcefba69", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 38 }, "payload_snippet": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "evidence": { "request_sample": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f6a97e55ab84400c84d03a03b6a3dfd503eb4855", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0363", "pat-0364" ], "tags_summary_labels_fr": [ "pat-0363", "pat-0364" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "mongodb wire protocol \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_hello_probe", "net_mongodb_probe" ] }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload FINS Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) FINS Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 20, "payload_entropy": 1.3917601481809734, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7557767ca98bb300b1834588fbf18102", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "FINS\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "FINS\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "FINS\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "FINS\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "FINS\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a9a39c0801c2dc0dfcaae867757e553113b4c5ad", "protocol_details": { "payload_preview": "FINS\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "FINS", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "FINS\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "FINS", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0532 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 14, "payload_entropy": 1.4299111709758698, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0532" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dfe54d23a8f0e41e768b7e668b0e1c4d", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\u0000\u0001\u0000\u0000\u0000\b\u0001\u0001\u0000\u0000\u0000\u0000\u0002\u0000", "request_sample": "\u0000\u0001\u0000\u0000\u0000\b\u0001\u0001\u0000\u0000\u0000\u0000\u0002\u0000", "payload_snippet": "\u0000\u0001\u0000\u0000\u0000\b\u0001\u0001\u0000\u0000\u0000\u0000\u0002\u0000", "evidence": { "request_sample": "\u0000\u0001\u0000\u0000\u0000\b\u0001\u0001\u0000\u0000\u0000\u0000\u0002\u0000", "payload_snippet": "\u0000\u0001\u0000\u0000\u0000\b\u0001\u0001\u0000\u0000\u0000\u0000\u0002\u0000", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3c7a006340407fb5d1f18f52edb20ae6a1974d3", "protocol_details": { "payload_preview": "\u0000\u0001\u0000\u0000\u0000\b\u0001\u0001\u0000\u0000\u0000\u0000\u0002\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0532" ], "tags_summary_labels_fr": [ "pat-0532" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0001\u0000\u0000\u0000\b\u0001\u0001\u0000\u0000\u0000\u0000\u0002\u0000", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
17/06/2026 20:49:16 UTC	TCP	9100 · JETDIRECT	jetdirect	jetdirect jetdirect · via JETDIRECT:9100 · (sonde / probe)	Faible	Faible · 6
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload �� Pourquoi cette classification : Type « jetdirect » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 6 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a", "emulator_response_len": 40, "bytes_in": 7, "payload_entropy": 1.5566567074628228, "port_category": "registered", "org": "Pilot Fiber, Inc.", "service": "jetdirect", "app_proto": "jetdirect", "asn": 46450, "country": "US", "dst_port": 9100, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 6, "tag_count": 0, "anomaly_count": 0, "campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72", "event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "service_name": "jetdirect", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 46450, "org": "Pilot Fiber, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e866e1d989e997db6ebf852e781b0c09", "path_pattern_hash": "c07c53e9d81674e63c0ba7ee4ce18080" }, "target_context": { "dst_port": 9100, "service": "jetdirect", "service_name": "jetdirect", "risk_score": 6 }, "payload_preview": "\ufffd\ufffd\u0001\u0000\u0000\u0000\u0001", "request_sample": "\ufffd\ufffd\u0001\u0000\u0000\u0000\u0001", "payload_snippet": "\ufffd\ufffd\u0001\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\ufffd\ufffd\u0001\u0000\u0000\u0000\u0001", "payload_snippet": "\ufffd\ufffd\u0001\u0000\u0000\u0000\u0001", "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e8a029a7269e96d29acf9e2479ab69c4da6b45f8", "protocol_details": { "payload_preview": "\ufffd\ufffd\u0001\u0000\u0000\u0000\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "evidence_snippet": "\ufffd\ufffd", "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab jetdirect \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 6 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 6, "risk_label": "Faible", "service_name": "jetdirect", "service_label_fr": "JETDIRECT", "dst_port": 9100, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-jetdirect", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\ufffd\ufffd\u0001\u0000\u0000\u0000\u0001", "port": 9100, "service": "jetdirect", "service_label_fr": "JETDIRECT" }, "attack_vector": "jetdirect \u00b7 via JETDIRECT:9100 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd", "target_port_label": "9100 \u00b7 JETDIRECT", "emulator_service": "jetdirect", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "jetdirect", "service_banner": "honeypot-jetdirect", "service_os": "linux", "dst_port": "9100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }

158.106.204.166

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence