17/06/2026 20:14:43 UTC
TCP
4369 · EPMD
Protocole wire MongoDB
mongodb wire protocol · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0363
pat-0364
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Requête brute (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-driver version 1.17.4 os . type darwin architecture arm64 platform go1.26.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 231,
"payload_entropy": 4.369460772401425,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b4e895a26960b7e91a5ee5603d3b9cfe009d403",
"event_fingerprint": "6bd9161494d3ebd07ae8330ca635086f7a51a764",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0363",
"pat-0364"
],
"kb_rule_ids": [
"pat-0363",
"pat-0364"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ad44bf19ea2ce10a5c567ffedcefba69",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 38
},
"payload_snippet": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"evidence": {
"request_sample": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2bd6e64d304231ca0802e19e29ac04e5e1052a8c",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0363",
"pat-0364"
],
"tags_summary_labels_fr": [
"pat-0363",
"pat-0364"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_mongodb_probe"
]
}
17/06/2026 20:14:43 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
root root networkscan/9600
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
root root networkscan/9600
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 28,
"payload_entropy": 3.624518654958899,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "457ab18c8fd02f0f3035a058670c8ebc",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "\u0000root\u0000root\u0000networkscan\/9600\u0000",
"request_sample": "\u0000root\u0000root\u0000networkscan\/9600\u0000",
"payload_snippet": "\u0000root\u0000root\u0000networkscan\/9600\u0000",
"evidence": {
"request_sample": "\u0000root\u0000root\u0000networkscan\/9600\u0000",
"payload_snippet": "\u0000root\u0000root\u0000networkscan\/9600\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f267bea39a84a6aeca68dddcfcb97bf6a6d2111a",
"protocol_details": {
"payload_preview": "\u0000root\u0000root\u0000networkscan\/9600\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "rootrootnetworkscan\/9600",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000root\u0000root\u0000networkscan\/9600\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "rootrootnetworkscan\/9600",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:43 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 4,
"payload_entropy": 2,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b5e91483d350b5a84c2bb3a7a72950d5",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "ls\r\n",
"request_sample": "ls\r\n",
"payload_snippet": "ls",
"evidence": {
"request_sample": "ls\r\n",
"payload_snippet": "ls",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2e98c9823b0156cc750ac069df082974c37553f",
"protocol_details": {
"payload_preview": "ls",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "ls",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "ls",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "ls",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:43 UTC
TCP
4369 · EPMD
Protocole wire MongoDB
mongodb wire protocol · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0363
pat-0364
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�
� admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Requête brute (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-driver version 1.17.4 os . type darwin architecture arm64 platform go1.26.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 231,
"payload_entropy": 4.369460772401425,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b4e895a26960b7e91a5ee5603d3b9cfe009d403",
"event_fingerprint": "6bd9161494d3ebd07ae8330ca635086f7a51a764",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0363",
"pat-0364"
],
"kb_rule_ids": [
"pat-0363",
"pat-0364"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1fe91dd7e3b6f00d70a2331e37a420ac",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 38
},
"payload_snippet": "\ufffd\u0000\u0000\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"evidence": {
"request_sample": "\ufffd\u0000\u0000\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a90b51cbf6211faa3b79b902ef82c29c084bb8b9",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\r\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0363",
"pat-0364"
],
"tags_summary_labels_fr": [
"pat-0363",
"pat-0364"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\r\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_mongodb_probe"
]
}
17/06/2026 20:14:43 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 4,
"payload_entropy": 0,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df3f619804a92fdb4057192dc43dd748",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4fb7548db37e2dab228573b4e2017d1914bd5332",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:43 UTC
TCP
4369 · EPMD
Sonde SMB
smb probe · via EPMD:4369 · (sonde / probe)
Faible
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
j3 =
Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0354
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SMB negotiate
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 28,
"payload_entropy": 1.303515793128299,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0354"
],
"kb_rule_ids": [
"pat-0354"
],
"matched_patterns": [
"pat-0354",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"SMB negotiate",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0354",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0fe58bec4bd3378af5b30506aefd1c9",
"path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 32
},
"payload_preview": "\u0000\u0000\u0000\u0001j3\u0000=\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004",
"request_sample": "\u0000\u0000\u0000\u0001j3\u0000=\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004",
"payload_snippet": "\u0000\u0000\u0000\u0001j3\u0000=\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0001j3\u0000=\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004",
"payload_snippet": "\u0000\u0000\u0000\u0001j3\u0000=\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a5e94a80569a9ddf86f6fb7c66dad4a59059a12",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001j3\u0000=\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "j3=",
"attack_vector": "smb probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0354"
],
"tags_summary_labels_fr": [
"pat-0354"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0001j3\u0000=\u0000\u0000\u0000\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "smb probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "j3=",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
Protocole wire MongoDB
mongodb wire protocol · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0363
pat-0364
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Requête brute (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-driver version 1.17.4 os . type darwin architecture arm64 platform go1.26.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 231,
"payload_entropy": 4.355412666350185,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b4e895a26960b7e91a5ee5603d3b9cfe009d403",
"event_fingerprint": "6bd9161494d3ebd07ae8330ca635086f7a51a764",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0363",
"pat-0364"
],
"kb_rule_ids": [
"pat-0363",
"pat-0364"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "afea43ef180701b4e2c72f9d598bc610",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 38
},
"payload_snippet": "\ufffd\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"evidence": {
"request_sample": "\ufffd\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "27fe4dbcc5aa1d2dd13fb11381cbb4743a94864c",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0363",
"pat-0364"
],
"tags_summary_labels_fr": [
"pat-0363",
"pat-0364"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_mongodb_probe"
]
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
NICK networkscanfp USER networkscanfp 0 * :networkscan
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0529
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
NICK networkscanfp
USER networkscanfp 0 * :networkscan
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 57,
"payload_entropy": 4.465988207178161,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0529"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0404b7509e014c4edc31542d095f75d3",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan\r\n",
"request_sample": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan\r\n",
"payload_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan",
"evidence": {
"request_sample": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan\r\n",
"payload_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1dfcfd3f719f7a86da27df389f4a2acea91c5063",
"protocol_details": {
"payload_preview": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0529"
],
"tags_summary_labels_fr": [
"pat-0529"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "NICK networkscanfp\r\nUSER networkscanfp 0 * :networkscan",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
Cross-site scripting
xss attack · via EPMD:4369 · (tentative d'exploit)
Faible
Faible · 39
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' versio
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Faible
· 39
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
LFI Double-dot bypass
XMPP stream
User-Agent
—
Règles WAF
—
Payload (extrait)
<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' versio
Requête brute (extrait)
<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 136,
"payload_entropy": 4.7035497892369795,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 39,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284",
"pat-0103",
"pat-0530"
],
"matched_pattern_names": [
"CRS 941130",
"LFI Double-dot bypass",
"XMPP stream"
],
"pattern_ids": [
"pat-0284",
"pat-0103",
"pat-0530"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 39
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4c1af05024003e93f859eb8590dac59c",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 39
},
"payload_preview": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio",
"request_sample": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' version='1.0'>",
"payload_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio",
"evidence": {
"request_sample": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' version='1.0'>",
"payload_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "230d3ec146551bc60446fd5ce686d710a543db7f",
"protocol_details": {
"payload_preview": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio",
"attack_vector": "xss attack \u00b7 via EPMD:4369 \u00b7 (tentative d'exploit)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via EPMD",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 39
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 39,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "xss attack \u00b7 via EPMD:4369 \u00b7 (tentative d'exploit)",
"evidence_snippet": "<?xml version='1.0'?><stream:stream to='62.3.50.33' xmlns='jabber:client' xmlns:stream='http:\/\/etherx.jabber.org\/streams' versio",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 96
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
1, 1
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 6,
"payload_entropy": 2.2516291673878226,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4dec1af7a5e8ffac3511945776621f67",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "1, 1\r\n",
"request_sample": "1, 1\r\n",
"payload_snippet": "1, 1",
"evidence": {
"request_sample": "1, 1\r\n",
"payload_snippet": "1, 1",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "52b379eff0cd1166c78ab49d7094d7e42679fa7d",
"protocol_details": {
"payload_preview": "1, 1",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "1, 1",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "1, 1",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "1, 1",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 2,
"payload_entropy": 1,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7eb70257593da06f682a3ddda54a9d26",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "\r\n",
"request_sample": "\r\n",
"evidence": {
"request_sample": "\r\n",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87bc1bef27db4590797fdad4aad171928051783d",
"protocol_details": {
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 16,
"payload_entropy": 0.6685644431995964,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ef30651f1b95b36f03bb51b641eaeda",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd84186eb3bc534fbfd2030ecdff2cba6368f0cc",
"protocol_details": {
"payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
0026git-upload-pack / host=62.3.50.33
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
0026git-upload-pack / host=62.3.50.33
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 38,
"payload_entropy": 4.4514890264306795,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cdeda6029ed66fc1799d1961e17d33df",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000",
"request_sample": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000",
"payload_snippet": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000",
"evidence": {
"request_sample": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000",
"payload_snippet": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4baba82a11b648c76c0f2dc9d3911b400b88ce9",
"protocol_details": {
"payload_preview": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "0026git-upload-pack \/host=62.3.50.33",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "0026git-upload-pack \/\u0000host=62.3.50.33\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "0026git-upload-pack \/host=62.3.50.33",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
root
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 6,
"payload_entropy": 2.2516291673878226,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b47c4c5f82a3b46964d446dca60c70bb",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "root\r\n",
"request_sample": "root\r\n",
"payload_snippet": "root",
"evidence": {
"request_sample": "root\r\n",
"payload_snippet": "root",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "571edbf3802a1ee709f5cef444fed166aa883a64",
"protocol_details": {
"payload_preview": "root",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "root",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "root",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "root",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
Protocole wire MongoDB
mongodb wire protocol · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0363
pat-0364
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Requête brute (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-driver version 1.17.4 os . type darwin architecture arm64 platform go1.26.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 231,
"payload_entropy": 4.360802763743417,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b4e895a26960b7e91a5ee5603d3b9cfe009d403",
"event_fingerprint": "6bd9161494d3ebd07ae8330ca635086f7a51a764",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0363",
"pat-0364"
],
"kb_rule_ids": [
"pat-0363",
"pat-0364"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "77660a67de2a981fd3aff48c423da93b",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 38
},
"payload_snippet": "\ufffd\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"evidence": {
"request_sample": "\ufffd\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5514384387e73a3fed9ec3cb2d5c4574d02820e2",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\t\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0363",
"pat-0364"
],
"tags_summary_labels_fr": [
"pat-0363",
"pat-0364"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\t\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_mongodb_probe"
]
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
example.com
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
example.com
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 13,
"payload_entropy": 3.3927474104487847,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b554204323efdd0397c86823d443ca92",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "example.com\r\n",
"request_sample": "example.com\r\n",
"payload_snippet": "example.com",
"evidence": {
"request_sample": "example.com\r\n",
"payload_snippet": "example.com",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2149f9913eace893b2aed024b4d40d278edd6686",
"protocol_details": {
"payload_preview": "example.com",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "example.com",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "example.com",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "example.com",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
%-12345X@PJL INFO ID %-12345X
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0514
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
%-12345X@PJL INFO ID
%-12345X
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 34,
"payload_entropy": 4.322756958897398,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0514"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "32da1f0d5c5a68cb1ebf5d845ec43555",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "\u001b%-12345X@PJL INFO ID\r\n\u001b%-12345X\r\n",
"request_sample": "\u001b%-12345X@PJL INFO ID\r\n\u001b%-12345X\r\n",
"payload_snippet": "\u001b%-12345X@PJL INFO ID\r\n\u001b%-12345X",
"evidence": {
"request_sample": "\u001b%-12345X@PJL INFO ID\r\n\u001b%-12345X\r\n",
"payload_snippet": "\u001b%-12345X@PJL INFO ID\r\n\u001b%-12345X",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6761851e359c79de7b5534f2ebcf5a7788ac99e",
"protocol_details": {
"payload_preview": "\u001b%-12345X@PJL INFO ID\r\n\u001b%-12345X",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "%-12345X@PJL INFO ID\r\n%-12345X",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0514"
],
"tags_summary_labels_fr": [
"pat-0514"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u001b%-12345X@PJL INFO ID\r\n\u001b%-12345X",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "%-12345X@PJL INFO ID\r\n%-12345X",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:42 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Moyenne
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
http2_preface
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
PRI * HTTP/2.0 SM
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 33,
"payload_entropy": 3.65045472541906,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "163edeca5e0f2b1a6918a65598185673d009d9a8",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da74b3e9488c0813fcd76f6273b0c115",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec2e485c9297f749b102fb441f322ed1292c6463",
"protocol_details": {
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http2_preface"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde port 4369/TCP
port 4369 tcp · via EPMD:4369 · (sonde / probe)
Faible
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Preuve honeypot — Sonde port 4369/TCP
Connexion détectée sur le port 4369 (TCP) du capteur simulé.
Service
EPMD
Payload
H �� ᯀ4]���� +.�m ]��� ��� +H`
Pourquoi cette classification : Type « port_4369_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1 Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
H �� ᯀ4]���� +.�m ]��� ��� +H`
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 72,
"payload_entropy": 3.9288024275565268,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2dca894a09b600e3818fd3a40f58b5bb",
"path_pattern_hash": "afe5dd09abed0d999a364e32ed80a9f9"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_preview": "\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0010\ufffd\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u1bc04]\ufffd\ufffd\u0011\ufffd\ufffd\b\u0000+.\ufffdm\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000",
"request_sample": "\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0010\ufffd\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u1bc04]\ufffd\ufffd\u0011\ufffd\ufffd\b\u0000+.\ufffdm\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000",
"payload_snippet": "\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0010\ufffd\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u1bc04]\ufffd\ufffd\u0011\ufffd\ufffd\b\u0000+.\ufffdm\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0010\ufffd\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u1bc04]\ufffd\ufffd\u0011\ufffd\ufffd\b\u0000+.\ufffdm\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000",
"payload_snippet": "\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0010\ufffd\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u1bc04]\ufffd\ufffd\u0011\ufffd\ufffd\b\u0000+.\ufffdm\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1da008568971f00648e9471b9e6205587b877cee",
"protocol_details": {
"payload_preview": "\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0010\ufffd\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u1bc04]\ufffd\ufffd\u0011\ufffd\ufffd\b\u0000+.\ufffdm\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "H\ufffd\ufffd\u1bc04]\ufffd\ufffd\ufffd\ufffd+.\ufffdm]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`",
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0010\ufffd\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u1bc04]\ufffd\ufffd\u0011\ufffd\ufffd\b\u0000+.\ufffdm\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "H\ufffd\ufffd\u1bc04]\ufffd\ufffd\ufffd\ufffd+.\ufffdm]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde SSH
Sonde SSH · via EPMD:4369 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
net_ssh_probe
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
SSH-2.0-GoSSHScanner
Pourquoi cette classification : Bannière client SSH reçue · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-GoSSHScanner
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 22,
"payload_entropy": 3.658993415253805,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e071cbaf518cfa5263c5870d45659d8411af7859",
"event_fingerprint": "dee5d10a336f8d5cc6eba692644496c980997fcd",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253"
],
"pattern_ids": [
"pat-0391"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f4ccad08e10e62a47cfa634d2aba613d",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 48
},
"payload_preview": "SSH-2.0-GoSSHScanner\r\n",
"request_sample": "SSH-2.0-GoSSHScanner\r\n",
"payload_snippet": "SSH-2.0-GoSSHScanner",
"evidence": {
"request_sample": "SSH-2.0-GoSSHScanner\r\n",
"payload_snippet": "SSH-2.0-GoSSHScanner",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85732d2613ad60ac8009a1b4f901d2598892b389",
"protocol_details": {
"payload_preview": "SSH-2.0-GoSSHScanner",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "SSH-2.0-GoSSHScanner",
"attack_vector": "Sonde SSH \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0391",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "SSH-2.0-GoSSHScanner",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "Sonde SSH \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-GoSSHScanner",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_ssh_probe",
"ssh_banner"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
���������������� � ���
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
���������������� � ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 29,
"payload_entropy": 2.2112607364322803,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d97ce8fcd995e33b6381798cd44b74da",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001d\u0001\u0004\ufffd\u0000\u0000\ufffd\ufffd\ufffd\u0001\u0001\u0000",
"request_sample": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001d\u0001\u0004\ufffd\u0000\u0000\ufffd\ufffd\ufffd\u0001\u0001\u0000",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001d\u0001\u0004\ufffd\u0000\u0000\ufffd\ufffd\ufffd\u0001\u0001\u0000",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001d\u0001\u0004\ufffd\u0000\u0000\ufffd\ufffd\ufffd\u0001\u0001\u0000",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001d\u0001\u0004\ufffd\u0000\u0000\ufffd\ufffd\ufffd\u0001\u0001\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d5978a0d91c50563d0ff2eeb6339b946ce24f78",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001d\u0001\u0004\ufffd\u0000\u0000\ufffd\ufffd\ufffd\u0001\u0001\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001d\u0001\u0004\ufffd\u0000\u0000\ufffd\ufffd\ufffd\u0001\u0001\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Moyenne
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
GET /version HTTP/1.1 Host: 62.3.50.33:4369 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /version HTTP/1.1
Host: 62.3.50.33:4369
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 103,
"payload_entropy": 4.968616494544723,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 32,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 32,
"novelty": 15
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3a7633c347dae468c74c1448b6f653eb40537dfb",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 32,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a901a8cc4553da31a240a4a03619e795",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 24
},
"payload_preview": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"request_sample": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"evidence": {
"request_sample": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "365156ec07b8df248a704f510bafc64d7a7d5393",
"protocol_details": {
"payload_preview": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 32,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde port 4369/TCP
port 4369 tcp · via EPMD:4369 · (sonde / probe)
Faible
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Preuve honeypot — Sonde port 4369/TCP
Connexion détectée sur le port 4369 (TCP) du capteur simulé.
Service
EPMD
Payload
� � � �
Pourquoi cette classification : Type « port_4369_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1 Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
S7 TPKT packet
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 22,
"payload_entropy": 2.9139770731827515,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0376",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"S7 TPKT packet",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0376",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f7037589effec294cf1e8529946582b1",
"path_pattern_hash": "afe5dd09abed0d999a364e32ed80a9f9"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0001\u0000\ufffd\u0002\u0000\u0001\ufffd\u0002\u0000\u0001\ufffd\u0001\n",
"request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0001\u0000\ufffd\u0002\u0000\u0001\ufffd\u0002\u0000\u0001\ufffd\u0001\n",
"payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0001\u0000\ufffd\u0002\u0000\u0001\ufffd\u0002\u0000\u0001\ufffd\u0001",
"evidence": {
"request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0001\u0000\ufffd\u0002\u0000\u0001\ufffd\u0002\u0000\u0001\ufffd\u0001\n",
"payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0001\u0000\ufffd\u0002\u0000\u0001\ufffd\u0002\u0000\u0001\ufffd\u0001",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36a1ccefa4e50e292fd7622a52b9705499290bdc",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0001\u0000\ufffd\u0002\u0000\u0001\ufffd\u0002\u0000\u0001\ufffd\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0001\u0000\ufffd\u0002\u0000\u0001\ufffd\u0002\u0000\u0001\ufffd\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 9,
"payload_entropy": 1.224394445405986,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8130a0ba1a45f483d4b86b557eefe19d",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "\u0005\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"request_sample": "\u0005\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0005\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0005\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0005\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1492ea7d8747ca58197387910e710e68f39b772",
"protocol_details": {
"payload_preview": "\u0005\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde HTTP smuggling
http smuggling probe · via EPMD:4369 · (tentative d'exploit)
Faible
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
POST / HTTP/1.1 Host: 62.3.50.33:4369 User-Agent: networkscan-ipp Content-Length: 94 Content-Type: application/ipp Accept-E
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Kafka ApiVersions key
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:4369
User-Agent: networkscan-ipp
Content-Length: 94
Content-Type: application/ipp
Accept-E
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:4369 User-Agent: networkscan-ipp Content-Length: 94 Content-Type: application/ipp Accept-Encoding: gzip G attributes-charset utf-8H attributes-natural-language en-usE printer-uri ipp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 239,
"payload_entropy": 5.2021178244414275,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 52,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0556",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Kafka ApiVersions key",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0842",
"pat-0556",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0a9e8fc3ef10151a404034014574c4cf",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 52
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-E",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-Encoding: gzip\r\n\r\n\u0001\u0001\u0000\u000b\u0000\u0000\u0000\u0001\u0001G\u0000\u0012attributes-charset\u0000\u0005utf-8H\u0000\u001battributes-natural-language\u0000\u0005en-usE\u0000\u000bprinter-uri\u0000\u0003ipp\u0003",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-E",
"evidence": {
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-Encoding: gzip\r\n\r\n\u0001\u0001\u0000\u000b\u0000\u0000\u0000\u0001\u0001G\u0000\u0012attributes-charset\u0000\u0005utf-8H\u0000\u001battributes-natural-language\u0000\u0005en-usE\u0000\u000bprinter-uri\u0000\u0003ipp\u0003",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-E",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ddb8b0247fcd4d2abfb7d13c9d043091281fa557",
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-E",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-E",
"attack_vector": "http smuggling probe \u00b7 via EPMD:4369 \u00b7 (tentative d'exploit)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via EPMD",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-E",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "http smuggling probe \u00b7 via EPMD:4369 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4369\r\nUser-Agent: networkscan-ipp\r\nContent-Length: 94\r\nContent-Type: application\/ipp\r\nAccept-E",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Protocole wire MongoDB
mongodb wire protocol · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0363
pat-0364
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
Mongo isMaster legacy
Mongo ismaster command
ET H.323 setup
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Requête brute (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-driver version 1.17.4 os . type darwin architecture arm64 platform go1.26.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 231,
"payload_entropy": 4.355412666350185,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b4e895a26960b7e91a5ee5603d3b9cfe009d403",
"event_fingerprint": "6bd9161494d3ebd07ae8330ca635086f7a51a764",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0363",
"pat-0364"
],
"kb_rule_ids": [
"pat-0363",
"pat-0364"
],
"matched_patterns": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0868",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"Mongo isMaster legacy",
"Mongo ismaster command",
"ET H.323 setup",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0868",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "35c9891bf4088a20a6c417ac96cca4b9",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 38
},
"payload_snippet": "\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"evidence": {
"request_sample": "\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9436310f1c88956eef7821387316c04babdfd229",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0363",
"pat-0364"
],
"tags_summary_labels_fr": [
"pat-0363",
"pat-0364"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_mongodb_probe"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
M2 � {�'�
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
M2
� {�'�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 17,
"payload_entropy": 3.6168746059562227,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dffda0b08a4e2cb49daf19bfa817a321",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "M2\r\u0000\u0001\u0000\u0000\u0000\u0007\ufffd\t\u0005\u0002{\ufffd'\ufffd",
"request_sample": "M2\r\u0000\u0001\u0000\u0000\u0000\u0007\ufffd\t\u0005\u0002{\ufffd'\ufffd",
"payload_snippet": "M2\r\u0000\u0001\u0000\u0000\u0000\u0007\ufffd\t\u0005\u0002{\ufffd'\ufffd",
"evidence": {
"request_sample": "M2\r\u0000\u0001\u0000\u0000\u0000\u0007\ufffd\t\u0005\u0002{\ufffd'\ufffd",
"payload_snippet": "M2\r\u0000\u0001\u0000\u0000\u0000\u0007\ufffd\t\u0005\u0002{\ufffd'\ufffd",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30ae0c2f94b6c44d014f9c749ef43a47e9b33f20",
"protocol_details": {
"payload_preview": "M2\r\u0000\u0001\u0000\u0000\u0000\u0007\ufffd\t\u0005\u0002{\ufffd'\ufffd",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "M2\r\ufffd\t{\ufffd'\ufffd",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "M2\r\u0000\u0001\u0000\u0000\u0000\u0007\ufffd\t\u0005\u0002{\ufffd'\ufffd",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "M2\r\ufffd\t{\ufffd'\ufffd",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde Memcached
memcached probe · via EPMD:4369 · (sonde / probe)
Faible
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
stats
Pourquoi cette classification : Type « memcached_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0374
pat-0533
pat-0865
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Memcached stats
Memcached stats
ET Memcached UDP
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 7,
"payload_entropy": 2.2359263506290326,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 50,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 164,
"precision_signals": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"kb_rule_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_patterns": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"matched_pattern_names": [
"Memcached stats",
"Memcached stats",
"ET Memcached UDP"
],
"pattern_ids": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "11e629574907d3a9ced402e26f4a98df",
"path_pattern_hash": "549d36783f9e3c43618e715d78a40b3b"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 50
},
"payload_preview": "stats\r\n",
"request_sample": "stats\r\n",
"payload_snippet": "stats",
"evidence": {
"request_sample": "stats\r\n",
"payload_snippet": "stats",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed3a638c1294a6b7f895ced8815d1cffb3b79fe8",
"protocol_details": {
"payload_preview": "stats",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "stats",
"attack_vector": "memcached probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via EPMD",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"tags_summary_labels_fr": [
"pat-0374",
"pat-0533",
"pat-0865"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "stats",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "memcached probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "stats",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde PostgreSQL
postgres probe · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� ��$щ�3�k��9�ܫ��k �k�Q\� � ���_��"}v���+�A���4!ȵxc�@��j( �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��$щ�3�k��9�ܫ��k �k�Q\� � ���_��"}v���+�A���4!ȵxc�@��j( �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��$щ�3�k��9�ܫ��k �k�Q\� � ���_��"}v���+�A���4!ȵxc�@��j( �+�/�,�0̨̩� �� � _ � ��� 2 + 3������q��2zآ`ڰ� �a�٪o�nc
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 1483,
"payload_entropy": 7.731586714222288,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b7311c5a8b4d475aa3a4a336e2f83c02846c1df9",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "db00389ccae4c40b42b22170f6e6bd7a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0011$\u0449\ufffd\u00153\ufffdk\ufffd\ufffd9\ufffd\u072b\ufffd\ufffdk\u001f\u0001\ufffdk\u001a\ufffd\u0012Q\\\ufffd\t\u0019\ufffd \ufffd\ufffd\ufffd_\ufffd\ufffd\"}\u0010v\ufffd\ufffd\ufffd+\ufffdA\ufffd\ufffd\ufffd4!\u0235x\u0007c\ufffd@\ufffd\ufffdj(\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0011$\u0449\ufffd\u00153\ufffdk\ufffd\ufffd9\ufffd\u072b\ufffd\ufffdk\u001f\u0001\ufffdk\u001a\ufffd\u0012Q\\\ufffd\t\u0019\ufffd \ufffd\ufffd\ufffd_\ufffd\ufffd\"}\u0010v\ufffd\ufffd\ufffd+\ufffdA\ufffd\ufffd\ufffd4!\u0235x\u0007c\ufffd@\ufffd\ufffdj(\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffdq\ufffd\ufffd2\u0005z\u0622`\u06b0\ufffd\n\ufffda\ufffd\u066ao\ufffdnc",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0011$\u0449\ufffd\u00153\ufffdk\ufffd\ufffd9\ufffd\u072b\ufffd\ufffdk\u001f\u0001\ufffdk\u001a\ufffd\u0012Q\\\ufffd\t\u0019\ufffd \ufffd\ufffd\ufffd_\ufffd\ufffd\"}\u0010v\ufffd\ufffd\ufffd+\ufffdA\ufffd\ufffd\ufffd4!\u0235x\u0007c\ufffd@\ufffd\ufffdj(\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "04f0f98adf2ba568c6faf40beea9cce7ebdb25c4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0011$\u0449\ufffd\u00153\ufffdk\ufffd\ufffd9\ufffd\u072b\ufffd\ufffdk\u001f\u0001\ufffdk\u001a\ufffd\u0012Q\\\ufffd\t\u0019\ufffd \ufffd\ufffd\ufffd_\ufffd\ufffd\"}\u0010v\ufffd\ufffd\ufffd+\ufffdA\ufffd\ufffd\ufffd4!\u0235x\u0007c\ufffd@\ufffd\ufffdj(\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffd\ufffd$\u0449\ufffd3\ufffdk\ufffd\ufffd9\ufffd\u072b\ufffd\ufffdk\ufffdk\ufffdQ\\\ufffd\t\ufffd \ufffd\ufffd\ufffd_\ufffd\ufffd\"}v\ufffd\ufffd\ufffd+\ufffdA\ufffd\ufffd\ufffd4!\u0235xc\ufffd@\ufffd\ufffdj(\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "postgres probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0011$\u0449\ufffd\u00153\ufffdk\ufffd\ufffd9\ufffd\u072b\ufffd\ufffdk\u001f\u0001\ufffdk\u001a\ufffd\u0012Q\\\ufffd\t\u0019\ufffd \ufffd\ufffd\ufffd_\ufffd\ufffd\"}\u0010v\ufffd\ufffd\ufffd+\ufffdA\ufffd\ufffd\ufffd4!\u0235x\u0007c\ufffd@\ufffd\ufffdj(\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "postgres probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd$\u0449\ufffd3\ufffdk\ufffd\ufffd9\ufffd\u072b\ufffd\ufffdk\ufffdk\ufffdQ\\\ufffd\t\ufffd \ufffd\ufffd\ufffd_\ufffd\ufffd\"}v\ufffd\ufffd\ufffd+\ufffdA\ufffd\ufffd\ufffd4!\u0235xc\ufffd@\ufffd\ufffdj(\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 12,
"payload_entropy": 2.4508257945180887,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f458fc12afe2c6bda83796bf902e8408",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001",
"request_sample": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001",
"payload_snippet": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001",
"evidence": {
"request_sample": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001",
"payload_snippet": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f7f68ae949527b5bcbd2388bfa79a4e2e23646e",
"protocol_details": {
"payload_preview": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "fox",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "fox\u0000\u0002\u0001\u0000\u0004\u0000\u0000\u0000\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "fox",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 84
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a9b6846df7c6ebb575095747dbd2466e",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"request_sample": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb329784e37760f4b92df2ba042508d7ab408e42",
"protocol_details": {
"payload_preview": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde PostgreSQL
postgres probe · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� �E��v1|/е��g�uew�;�0e?��}�; ������*jzO� X9z�q+ w�D�R���� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �E��v1|/е��g�uew�;�0e?��}�; ������*jzO� X9z�q+ w�D�R���� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �E��v1|/е��g�uew�;�0e?��}�; ������*jzO� X9z�q+ w�D�R���� �+�/�,�0̨̩� �� � _ � ��� 2 + 3�������`��)T�fQ�f�5 ��5�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 1483,
"payload_entropy": 7.73885326250076,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b7311c5a8b4d475aa3a4a336e2f83c02846c1df9",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48800eeef1f672bcb69794df64f96db4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\u0003v1|\/\u0435\ufffd\ufffdg\ufffduew\ufffd;\ufffd0e?\ufffd\u0005\u0013\u0014\ufffd\u0019}\ufffd; \u0007\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*jzO\ufffd\u001dX\u00109z\ufffdq+ w\ufffdD\ufffd\u0010R\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\u0003v1|\/\u0435\ufffd\ufffdg\ufffduew\ufffd;\ufffd0e?\ufffd\u0005\u0013\u0014\ufffd\u0019}\ufffd; \u0007\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*jzO\ufffd\u001dX\u00109z\ufffdq+ w\ufffdD\ufffd\u0010R\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u0013\ufffd`\ufffd\ufffd)T\ufffdfQ\ufffdf\ufffd5\u000b\ufffd\u0013\ufffd5\ufffd\u0016",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\u0003v1|\/\u0435\ufffd\ufffdg\ufffduew\ufffd;\ufffd0e?\ufffd\u0005\u0013\u0014\ufffd\u0019}\ufffd; \u0007\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*jzO\ufffd\u001dX\u00109z\ufffdq+ w\ufffdD\ufffd\u0010R\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8a7b83730024f21abba00e550c79dffb46c744d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\u0003v1|\/\u0435\ufffd\ufffdg\ufffduew\ufffd;\ufffd0e?\ufffd\u0005\u0013\u0014\ufffd\u0019}\ufffd; \u0007\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*jzO\ufffd\u001dX\u00109z\ufffdq+ w\ufffdD\ufffd\u0010R\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffdE\ufffd\ufffdv1|\/\u0435\ufffd\ufffdg\ufffduew\ufffd;\ufffd0e?\ufffd\ufffd}\ufffd; \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*jzO\ufffdX9z\ufffdq+ w\ufffdD\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "postgres probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\u0003v1|\/\u0435\ufffd\ufffdg\ufffduew\ufffd;\ufffd0e?\ufffd\u0005\u0013\u0014\ufffd\u0019}\ufffd; \u0007\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*jzO\ufffd\u001dX\u00109z\ufffdq+ w\ufffdD\ufffd\u0010R\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "postgres probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdE\ufffd\ufffdv1|\/\u0435\ufffd\ufffdg\ufffduew\ufffd;\ufffd0e?\ufffd\ufffd}\ufffd; \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*jzO\ufffdX9z\ufffdq+ w\ufffdD\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 24,
"payload_entropy": 0.24988229283318544,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d98b4c95d89a83c72b8b3ef5e42fc38c",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81984f892123cbfd79f1ef1405de4ce531bc6f2a",
"protocol_details": {
"payload_preview": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "c",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "c",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
SSRF interne
ssrf internal · via EPMD:4369 · (tentative d'exploit)
Faible
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� <, � � � : (DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Moyen
· 46
Confiance : Confiance 54 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Oracle TNS connect
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� <, � � � : (DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI
Requête brute (extrait)
� <, � � � : (DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CID=(PROGRAM=networkscan)(HOST=localhost)(USER=)))(ADDRESS=(PROTOCOL=tcp)(HOST=62.3.50.33)(PORT=4369)))
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 229,
"payload_entropy": 4.941352435618592,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 46,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0520",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Oracle TNS connect",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0520",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "epmd",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7817f5b4209264ed6ad7f24e9a13bb4b",
"path_pattern_hash": "2926fa5ba65a298fe7630f4e1d1dd6ea"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 46
},
"payload_preview": "\u0000\ufffd\u0000\u0000\u0001\u0000\u0000\u0000\u0001<\u0001,\u0000\u0000\ufffd\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000\ufffd\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI",
"request_sample": "\u0000\ufffd\u0000\u0000\u0001\u0000\u0000\u0000\u0001<\u0001,\u0000\u0000\ufffd\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000\ufffd\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CID=(PROGRAM=networkscan)(HOST=localhost)(USER=)))(ADDRESS=(PROTOCOL=tcp)(HOST=62.3.50.33)(PORT=4369)))",
"payload_snippet": "\u0000\ufffd\u0000\u0000\u0001\u0000\u0000\u0000\u0001<\u0001,\u0000\u0000\ufffd\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000\ufffd\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI",
"evidence": {
"request_sample": "\u0000\ufffd\u0000\u0000\u0001\u0000\u0000\u0000\u0001<\u0001,\u0000\u0000\ufffd\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000\ufffd\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CID=(PROGRAM=networkscan)(HOST=localhost)(USER=)))(ADDRESS=(PROTOCOL=tcp)(HOST=62.3.50.33)(PORT=4369)))",
"payload_snippet": "\u0000\ufffd\u0000\u0000\u0001\u0000\u0000\u0000\u0001<\u0001,\u0000\u0000\ufffd\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000\ufffd\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "942f210be1c86f379ca1d7fb625b68db69fe7f81",
"protocol_details": {
"payload_preview": "\u0000\ufffd\u0000\u0000\u0001\u0000\u0000\u0000\u0001<\u0001,\u0000\u0000\ufffd\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000\ufffd\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd<,\ufffd\ufffd\ufffd:(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI",
"attack_vector": "ssrf internal \u00b7 via EPMD:4369 \u00b7 (tentative d'exploit)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via EPMD",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0000\ufffd\u0000\u0000\u0001\u0000\u0000\u0000\u0001<\u0001,\u0000\u0000\ufffd\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000\ufffd\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "ssrf internal \u00b7 via EPMD:4369 \u00b7 (tentative d'exploit)",
"evidence_snippet": "\ufffd<,\ufffd\ufffd\ufffd:(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=NONEXISTENT_SVC_PROBE_XYZ)(CI",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde Java RMI
java rmi probe · via EPMD:4369 · (sonde / probe)
Faible
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
JRMI LP�� w" DM���;�
Pourquoi cette classification : Type « java_rmi_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0604
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Java RMI JRMI
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
JRMI LP�� w" DM���;�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 48,
"payload_entropy": 2.8686716140875377,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0604"
],
"kb_rule_ids": [
"pat-0604"
],
"matched_patterns": [
"pat-0604",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Java RMI JRMI",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0604",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c93bd009b6a661ab60139d3d599602a7",
"path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 32
},
"payload_preview": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd",
"request_sample": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd",
"payload_snippet": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd",
"evidence": {
"request_sample": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd",
"payload_snippet": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd",
"classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ff2b86fc2ff1eaaacd417b189ea2c47c0937175",
"protocol_details": {
"payload_preview": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "JRMILP\ufffd\ufffdw\"DM\ufffd\ufffd\ufffd;\ufffd",
"attack_vector": "java rmi probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0604"
],
"tags_summary_labels_fr": [
"pat-0604"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "JRMI\u0000\u0002LP\ufffd\ufffd\u0000\u0005w\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001D\u0015M\ufffd\ufffd\ufffd;\ufffd",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "java rmi probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "JRMILP\ufffd\ufffdw\"DM\ufffd\ufffd\ufffd;\ufffd",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde port 4369/TCP
port 4369 tcp · via EPMD:4369 · (sonde / probe)
Faible
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Preuve honeypot — Sonde port 4369/TCP
Connexion détectée sur le port 4369 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_4369_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1 Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "93f1c4418cec9ea1e95227d4493b77a7",
"path_pattern_hash": "afe5dd09abed0d999a364e32ed80a9f9"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_preview": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38db4fbed779e617fcc4013c6f55fe9abd322953",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Protocole wire MongoDB
mongodb wire protocol · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0363
pat-0364
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-
Requête brute (extrait)
� � admin.$cmd ����� isMaster helloOk compression client � driver 3 name mongo-go-driver version 1.17.4 os . type darwin architecture arm64 platform go1.26.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 231,
"payload_entropy": 4.360802763743417,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b4e895a26960b7e91a5ee5603d3b9cfe009d403",
"event_fingerprint": "6bd9161494d3ebd07ae8330ca635086f7a51a764",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0363",
"pat-0364"
],
"kb_rule_ids": [
"pat-0363",
"pat-0364"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4730cad5defa7a68a31d4046d0150bba",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 38
},
"payload_snippet": "\ufffd\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"evidence": {
"request_sample": "\ufffd\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.17.4\u0000\u0000\u0003os\u0000.\u0000\u0000\u0000\u0002type\u0000\u0007\u0000\u0000\u0000darwin\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000arm64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.26.1\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1dfd0a11160f0ad44604c25bc8d6487b431780d8",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0363",
"pat-0364"
],
"tags_summary_labels_fr": [
"pat-0363",
"pat-0364"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mongodb wire protocol \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdadmin.$cmd\ufffd\ufffd\ufffd\ufffd\ufffdisMasterhelloOkcompressionclient\ufffddriver3namemongo-go-",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_mongodb_probe"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde Java RMI
java rmi probe · via EPMD:4369 · (sonde / probe)
Faible
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
JRMI K
Pourquoi cette classification : Type « java_rmi_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0604
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Java RMI JRMI
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 7,
"payload_entropy": 2.807354922057604,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 32,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0604"
],
"kb_rule_ids": [
"pat-0604"
],
"matched_patterns": [
"pat-0604"
],
"matched_pattern_names": [
"Java RMI JRMI"
],
"pattern_ids": [
"pat-0604"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d8c49a0f759e2102fb8fa8368049d06a",
"path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 32
},
"payload_preview": "JRMI\u0000\u0002K",
"request_sample": "JRMI\u0000\u0002K",
"payload_snippet": "JRMI\u0000\u0002K",
"evidence": {
"request_sample": "JRMI\u0000\u0002K",
"payload_snippet": "JRMI\u0000\u0002K",
"classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac939d5b2b82d22293f8a0135b8aa1540f0a33be",
"protocol_details": {
"payload_preview": "JRMI\u0000\u0002K",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "JRMIK",
"attack_vector": "java rmi probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0604"
],
"tags_summary_labels_fr": [
"pat-0604"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "JRMI\u0000\u0002K",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "java rmi probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "JRMIK",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Protocole TDS MSSQL
mssql tds · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
mssql_tds
net_mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0536
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 5,
"payload_entropy": 2.321928094887362,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "16d29f43e53b40ae98121a74fa9c32d223328659",
"event_fingerprint": "90173f5ab1faafa7393867ce4da0cf2f6de9f41c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0536"
],
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "998c4c91063c53dbcdff933fad5ea02c",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 32
},
"payload_preview": "\u00124\u0000\u0001\n",
"request_sample": "\u00124\u0000\u0001\n",
"payload_snippet": "\u00124\u0000\u0001",
"evidence": {
"request_sample": "\u00124\u0000\u0001\n",
"payload_snippet": "\u00124\u0000\u0001",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e386cd5a2efcd0038aab8d0416214daf4f326aef",
"protocol_details": {
"payload_preview": "\u00124\u0000\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "4",
"attack_vector": "mssql tds \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0536"
],
"tags_summary_labels_fr": [
"pat-0536"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u00124\u0000\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mssql tds \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "4",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_tds",
"net_mssql_tds"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Moyenne
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
http2_preface
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
PRI * HTTP/2.0 SM
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 24,
"payload_entropy": 3.66829583405449,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "163edeca5e0f2b1a6918a65598185673d009d9a8",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bd71964d35f553a9e1d0cddcb5864e08",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 24
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM",
"evidence": {
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3832ee025579bfc242cec99e7ff0ae3fe078ce62",
"protocol_details": {
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http2_preface"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 36,
"payload_entropy": 3.648511114409896,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c4a322957c509946d1f9b0623002bd689817bbf",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
ruok
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 4,
"payload_entropy": 2,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29f8a395031b075d400c3d55eaeb0f0a",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "ruok",
"request_sample": "ruok",
"payload_snippet": "ruok",
"evidence": {
"request_sample": "ruok",
"payload_snippet": "ruok",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c440a432cef6165f1f4a32a8420d97fd3f3eb28c",
"protocol_details": {
"payload_preview": "ruok",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "ruok",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "ruok",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "ruok",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
amqp probe
amqp probe · via EPMD:4369 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Investiguer
Tags
amqp_handshake
net_amqp_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
AMQP
Pourquoi cette classification : Type « amqp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Proto Amqp Auth
pat-0371
pat-0537
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
AMQP protocol
AMQP protocol header
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 8,
"payload_entropy": 2.75,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 43,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 50,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "d57a43c2d40a3464146df37dfc2de67db28f76cd",
"event_fingerprint": "b484c7b84107076a624d5bb403fd23bdef097587",
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 199,
"precision_signals": [
"INT-PROTO-amqp-auth",
"pat-0371",
"pat-0537",
"INT-upstream"
],
"kb_rule_ids": [
"INT-PROTO-amqp-auth",
"pat-0371",
"pat-0537",
"INT-upstream"
],
"matched_patterns": [
"pat-0371",
"pat-0537"
],
"matched_pattern_names": [
"AMQP protocol",
"AMQP protocol header"
],
"pattern_ids": [
"pat-0371",
"pat-0537"
],
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bc2f502576523902588d3c36f36ea5a1",
"path_pattern_hash": "e0a8a2707ca9342b66a175c0e4383ba0"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 50
},
"payload_preview": "AMQP\u0000\u0000\t\u0001",
"request_sample": "AMQP\u0000\u0000\t\u0001",
"payload_snippet": "AMQP\u0000\u0000\t\u0001",
"evidence": {
"request_sample": "AMQP\u0000\u0000\t\u0001",
"payload_snippet": "AMQP\u0000\u0000\t\u0001",
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50f11d055aad17de28ca29cb593a6312593f95ee",
"protocol_details": {
"payload_preview": "AMQP\u0000\u0000\t\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "AMQP",
"attack_vector": "amqp probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via EPMD",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"INT-PROTO-amqp-auth",
"pat-0371",
"pat-0537",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Proto Amqp Auth",
"pat-0371",
"pat-0537",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "AMQP\u0000\u0000\t\u0001",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "amqp probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "AMQP",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"amqp_handshake",
"net_amqp_probe"
]
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 8
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
CNXN 2 ����host::
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
CNXN 2 ����host::
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 31,
"payload_entropy": 3.3729205036561045,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "epmd",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2ab0510cc4156c41c24112bc2a720db2",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 8
},
"payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
"request_sample": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
"payload_snippet": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
"evidence": {
"request_sample": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
"payload_snippet": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bca730f6ed021475fce3db9fbc196900996f9f24",
"protocol_details": {
"payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "CNXN2\ufffd\ufffd\ufffd\ufffdhost::",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000\ufffd\ufffd\ufffd\ufffdhost::\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "CNXN2\ufffd\ufffd\ufffd\ufffdhost::",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
Sonde port 4369/TCP
port 4369 tcp · via EPMD:4369 · (sonde / probe)
Faible
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Preuve honeypot — Sonde port 4369/TCP
Connexion détectée sur le port 4369 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_4369_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1 Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Mumble ping
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 1537,
"payload_entropy": 0.007825717024736212,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0768",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Mumble ping",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0768",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b7812b6cee81237900f8087692e9d6df",
"path_pattern_hash": "afe5dd09abed0d999a364e32ed80a9f9"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_snippet": "\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bfb4cbfd7cd93030e4acc82a6ad917b235a3e9c",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_4369_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "port 4369 tcp \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:41 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22531c50c4076e9401fba28a066d3db96533aa19",
"protocol_details": {
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:33 UTC
TCP
4369 · EPMD
Sonde PostgreSQL
postgres probe · via EPMD:4369 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
� �W�O�R�g��܂��fc� ���4�~v?� Xֶ <�0��C@� ��Y! ��M 1�a�@��D�+� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �W�O�R�g��܂��fc�
���4�~v?�
Xֶ <�0��C@� ��Y! ��M 1�a�@��D�+� 2�+�/�,�0̨̩� ��
� � � / 5�
�#�' <��
Requête brute (extrait)
� �W�O�R�g��܂��fc� ���4�~v?� Xֶ <�0��C@� ��Y! ��M 1�a�@��D�+� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <�� c � ��� 2 + 3��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 1511,
"payload_entropy": 7.7170049030994825,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b7311c5a8b4d475aa3a4a336e2f83c02846c1df9",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b5dc6155bbdc5eb0f57df3cc215a97ee",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019W\ufffdO\ufffdR\ufffdg\ufffd\ufffd\u0702\ufffd\ufffdfc\ufffd\r\ufffd\ufffd\ufffd4\ufffd~v?\ufffd\rX\u05b6 <\ufffd0\ufffd\ufffdC@\ufffd\u001d\u001c\ufffd\ufffdY!\f\ufffd\ufffdM\u001f1\ufffda\ufffd@\ufffd\u0017\ufffdD\ufffd+\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019W\ufffdO\ufffdR\ufffdg\ufffd\ufffd\u0702\ufffd\ufffdfc\ufffd\r\ufffd\ufffd\ufffd4\ufffd~v?\ufffd\rX\u05b6 <\ufffd0\ufffd\ufffdC@\ufffd\u001d\u001c\ufffd\ufffdY!\f\ufffd\ufffdM\u001f1\ufffda\ufffd@\ufffd\u0017\ufffdD\ufffd+\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019W\ufffdO\ufffdR\ufffdg\ufffd\ufffd\u0702\ufffd\ufffdfc\ufffd\r\ufffd\ufffd\ufffd4\ufffd~v?\ufffd\rX\u05b6 <\ufffd0\ufffd\ufffdC@\ufffd\u001d\u001c\ufffd\ufffdY!\f\ufffd\ufffdM\u001f1\ufffda\ufffd@\ufffd\u0017\ufffdD\ufffd+\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9747213f47ab9f9492f26fe0068e8f2702ac4117",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019W\ufffdO\ufffdR\ufffdg\ufffd\ufffd\u0702\ufffd\ufffdfc\ufffd\r\ufffd\ufffd\ufffd4\ufffd~v?\ufffd\rX\u05b6 <\ufffd0\ufffd\ufffdC@\ufffd\u001d\u001c\ufffd\ufffdY!\f\ufffd\ufffdM\u001f1\ufffda\ufffd@\ufffd\u0017\ufffdD\ufffd+\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "\ufffd\ufffdW\ufffdO\ufffdR\ufffdg\ufffd\ufffd\u0702\ufffd\ufffdfc\ufffd\r\ufffd\ufffd\ufffd4\ufffd~v?\ufffd\rX\u05b6 <\ufffd0\ufffd\ufffdC@\ufffd\ufffd\ufffdY!\ufffd\ufffdM1\ufffda\ufffd@\ufffd\ufffdD\ufffd+\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019W\ufffdO\ufffdR\ufffdg\ufffd\ufffd\u0702\ufffd\ufffdfc\ufffd\r\ufffd\ufffd\ufffd4\ufffd~v?\ufffd\rX\u05b6 <\ufffd0\ufffd\ufffdC@\ufffd\u001d\u001c\ufffd\ufffdY!\f\ufffd\ufffdM\u001f1\ufffda\ufffd@\ufffd\u0017\ufffdD\ufffd+\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "postgres probe \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdW\ufffdO\ufffdR\ufffdg\ufffd\ufffd\u0702\ufffd\ufffdfc\ufffd\r\ufffd\ufffd\ufffd4\ufffd~v?\ufffd\rX\u05b6 <\ufffd0\ufffd\ufffdC@\ufffd\ufffd\ufffdY!\ufffd\ufffdM1\ufffda\ufffd@\ufffd\ufffdD\ufffd+\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
17/06/2026 20:14:33 UTC
TCP
4369 · EPMD
Botnet Mozi
mozi pattern · via EPMD:4369 · (commande & contrôle)
Élevée
Faible · 38
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 38
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 184,
"payload_entropy": 5.375635561415027,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d15c52786cbfa24b06e8c634709be8e07dc4b731",
"event_fingerprint": "6b007342d6072e19cd0c006e0caa3e8e5376be36",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "39af03a5c2d96a346d228183e2226a52",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/127.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/127.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b87b802ae9eddb998f46e0aab2d6065819b71d68",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
"attack_vector": "mozi pattern \u00b7 via EPMD:4369 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via EPMD",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "mozi pattern \u00b7 via EPMD:4369 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) C",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
17/06/2026 20:14:33 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Service
EPMD
Payload
-�Fa� s �㫖vW�L���ijZ��8�/ $ ���Ģ�K���5k�(v��2�n� z�g-�)
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
-�Fa�
s �㫖vW�L���ijZ��8�/
$
���Ģ�K���5k�(v��2�n� z�g-�)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"bytes_in": 64,
"payload_entropy": 5.800704882778696,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dfedb782ec3faf367320d494eb691103",
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"payload_preview": "-\u0003\ufffdFa\ufffd\rs\t\ufffd\u3ad6v\u0003W\ufffdL\ufffd\ufffd\u0018\ufffdijZ\u000e\ufffd\ufffd8\u0016\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\u001b\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffd\u000bz\ufffdg-\ufffd)",
"request_sample": "-\u0003\ufffdFa\ufffd\rs\t\ufffd\u3ad6v\u0003W\ufffdL\ufffd\ufffd\u0018\ufffdijZ\u000e\ufffd\ufffd8\u0016\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\u001b\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffd\u000bz\ufffdg-\ufffd)",
"payload_snippet": "-\u0003\ufffdFa\ufffd\rs\t\ufffd\u3ad6v\u0003W\ufffdL\ufffd\ufffd\u0018\ufffdijZ\u000e\ufffd\ufffd8\u0016\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\u001b\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffd\u000bz\ufffdg-\ufffd)",
"evidence": {
"request_sample": "-\u0003\ufffdFa\ufffd\rs\t\ufffd\u3ad6v\u0003W\ufffdL\ufffd\ufffd\u0018\ufffdijZ\u000e\ufffd\ufffd8\u0016\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\u001b\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffd\u000bz\ufffdg-\ufffd)",
"payload_snippet": "-\u0003\ufffdFa\ufffd\rs\t\ufffd\u3ad6v\u0003W\ufffdL\ufffd\ufffd\u0018\ufffdijZ\u000e\ufffd\ufffd8\u0016\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\u001b\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffd\u000bz\ufffdg-\ufffd)",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84147a0b0fb4e840d3abbc2456a5b89ced13c1c4",
"protocol_details": {
"payload_preview": "-\u0003\ufffdFa\ufffd\rs\t\ufffd\u3ad6v\u0003W\ufffdL\ufffd\ufffd\u0018\ufffdijZ\u000e\ufffd\ufffd8\u0016\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\u001b\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffd\u000bz\ufffdg-\ufffd)",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"evidence_snippet": "-\ufffdFa\ufffd\rs\t\ufffd\u3ad6vW\ufffdL\ufffd\ufffd\ufffdijZ\ufffd\ufffd8\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffdz\ufffdg-\ufffd)",
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "-\u0003\ufffdFa\ufffd\rs\t\ufffd\u3ad6v\u0003W\ufffdL\ufffd\ufffd\u0018\ufffdijZ\u000e\ufffd\ufffd8\u0016\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\u001b\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffd\u000bz\ufffdg-\ufffd)",
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": "-\ufffdFa\ufffd\rs\t\ufffd\u3ad6vW\ufffdL\ufffd\ufffd\ufffdijZ\ufffd\ufffd8\ufffd\/\n$\r\ufffd\ufffd\ufffd\u0122\ufffdK\ufffd\ufffd\ufffd5k\ufffd(v\ufffd\ufffd2\ufffdn\ufffdz\ufffdg-\ufffd)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
17/06/2026 20:14:33 UTC
TCP
4369 · EPMD
epmd
epmd · via EPMD:4369 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
EPMD
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4369
Chemin / cible
—
Pourquoi cette classification : Type « epmd » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742065706d6420726561647920706f72743d343336390d0a",
"emulator_response_len": 35,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Pilot Fiber, Inc.",
"service": "epmd",
"app_proto": "epmd",
"asn": 46450,
"country": "US",
"dst_port": 4369,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0db9abb3440dca14c19e8a9f3796f5b386f3e8e3",
"event_fingerprint": "5dd21f1dc188661a437472eaf9fc5811bcc1a829",
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "epmd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 46450,
"org": "Pilot Fiber, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "511947b0ac3d443a8f5be5198eff616c"
},
"target_context": {
"dst_port": 4369,
"service": "epmd",
"service_name": "epmd",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22531c50c4076e9401fba28a066d3db96533aa19",
"protocol_details": {
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab epmd \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "epmd",
"service_label_fr": "EPMD",
"dst_port": 4369,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-epmd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 4369,
"service": "epmd",
"service_label_fr": "EPMD"
},
"attack_vector": "epmd \u00b7 via EPMD:4369 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4369 \u00b7 EPMD",
"emulator_service": "epmd",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "epmd",
"service_banner": "honeypot-epmd",
"service_os": "linux",
"dst_port": "4369"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}