{"ip":"178.44.116.194","exported_at":"2026-10-27T09:57:43+00:00","period_days":30,"metrics":{"events7d":2724,"distinct_ports":1,"distinct_classifications":2,"max_severity":6,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":21,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["database_scan"],"recommended_action":"monitor","confidence":0,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":25},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":2724,"executive_one_liner_fr":"Activit\u00e9 suspecte","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":25,"risk_score":21},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":0,"confidence_hint_fr":"Confiance non \u00e9tablie","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":"mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)","protocol_details":{"mssql_tds_fr":"Connexion TDS Microsoft SQL Server","payload_preview":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b#\ufffd\u0000\u0000\u0000\u0000\u0000\u0000*\u001c\u0000\ufffd\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\n\u0000\u0000\u0001","port":1433,"service":"mssql","service_label_fr":"MSSQL"},"protocol_summary_fr":"Payload \u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b#\ufffd\u0000\u0000\u0000\u0000\u0000\u0000*\u001c\u0000\ufffd\u0010\u04b0\ufffdpE\u2026 \u00b7 MSSQL:1433","evidence_snippet":"^$*+,01$U\ufffd#\ufffd*\ufffd\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd","target_port_label":"1433 \u00b7 MSSQL","emulator_service":"mssql","confidence_reason":"Confiance 0 % \u2014 6 signal(aux) capteur","classification_reason":"Rafale d\u0027authentification SSH \u00b7 confiance 0%","classification_reason_label_fr":"Rafale d\u0027authentification SSH \u00b7 confiance 0%","confidence_factors_fr":null,"payload_preview":"^$*+,01$U\ufffd#\ufffd*\ufffd\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"194.116.44.178.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":8053878,"ip":"178.44.116.194","ts":"2026-10-25 05:58:08.000000","proto":"tcp","src_port":61050,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.659740842933593, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002235fa6c18c1b45b5b3f682cdf3d3986c1\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002271c59c7637b07d8866087f33d854f9ec4b83194d\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\u0010\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\u04b0\ufffdpEN\ufffd1nki\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053877,"ip":"178.44.116.194","ts":"2026-10-25 05:58:08.000000","proto":"tcp","src_port":61028,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.611556534284862, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c6ede8157be204527076e342fc2570af\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u001b1\\u0001\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u001b1\\u0001\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u001b1\\u0001\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u001b1\\u0001\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u001b1\\u0001\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ccdf22a1edd158c9d98d56ed679511dcc12356bf\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u001b1\\u0001\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*1\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u001b1\\u0001\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*1\ufffd\ufffd\ufffdUE\ufffd\ufffd_\ufffd\ufffdy\ufffd3\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053875,"ip":"178.44.116.194","ts":"2026-10-25 05:58:08.000000","proto":"tcp","src_port":60999,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.731601348275758, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224f7159414da947c48529c7cde5db4947\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022378a3bf28536c0e6b7030a985429467cd4a6f05a\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd.S!F\ufffdhB\ufffd\\r\ufffd{\ufffd\ufffdR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053872,"ip":"178.44.116.194","ts":"2026-10-25 05:58:07.000000","proto":"tcp","src_port":60972,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.7103247525310765, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e1c067bdbc0a914a987a24f31724b45d\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u00dem\\\\\ufffdX\\u001bC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u00dem\\\\\ufffdX\\u001bC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u00dem\\\\\ufffdX\\u001bC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u00dem\\\\\ufffdX\\u001bC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u00dem\\\\\ufffdX\\u001bC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a6297d346ef810f59570fb502d42e1bec64d3487\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u00dem\\\\\ufffdX\\u001bC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\u00dem\\\\\ufffdXC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u00dem\\\\\ufffdX\\u001bC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\u00dem\\\\\ufffdXC\ufffd\ufffdH\ufffd\ufffd[ Z\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053870,"ip":"178.44.116.194","ts":"2026-10-25 05:58:07.000000","proto":"tcp","src_port":60940,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.689048156786396, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221c00c2c660c8d515a3ca466a23cc6caf\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdsGm\ufffdIiJ\ufffd\\u001bui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdsGm\ufffdIiJ\ufffd\\u001bui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdsGm\ufffdIiJ\ufffd\\u001bui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdsGm\ufffdIiJ\ufffd\\u001bui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdsGm\ufffdIiJ\ufffd\\u001bui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ced7d6f537e104f01bccf81490ede0706c5e9d17\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdsGm\ufffdIiJ\ufffd\\u001bui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffdsGm\ufffdIiJ\ufffdui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdsGm\ufffdIiJ\ufffd\\u001bui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffdsGm\ufffdIiJ\ufffdui\u0027[\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053865,"ip":"178.44.116.194","ts":"2026-10-25 05:58:07.000000","proto":"tcp","src_port":60913,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.646494965297034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002228c4ae746b4bf804413a86e1d7fa0464\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdz\ufffd\ufffd\ufffd\\u000e`A\ufffd\ufffd\\u0017U\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdz\ufffd\ufffd\ufffd\\u000e`A\ufffd\ufffd\\u0017U\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdz\ufffd\ufffd\ufffd\\u000e`A\ufffd\ufffd\\u0017U\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdz\ufffd\ufffd\ufffd\\u000e`A\ufffd\ufffd\\u0017U\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdz\ufffd\ufffd\ufffd\\u000e`A\ufffd\ufffd\\u0017U\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022919f6ca05557e140c5b7017b2c57b3e1f35b7ce8\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdz\ufffd\ufffd\ufffd\\u000e`A\ufffd\ufffd\\u0017U\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffdz\ufffd\ufffd\ufffd`A\ufffd\ufffdU\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdz\ufffd\ufffd\ufffd\\u000e`A\ufffd\ufffd\\u0017U\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffdz\ufffd\ufffd\ufffd`A\ufffd\ufffdU\u0027\ufffd+\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053864,"ip":"178.44.116.194","ts":"2026-10-25 05:58:07.000000","proto":"tcp","src_port":60890,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.60915693333611, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223068d677dbbc400f251762710a587acb\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000l\ufffd\ufffd\\u001d1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000l\ufffd\ufffd\\u001d1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000l\ufffd\ufffd\\u001d1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000l\ufffd\ufffd\\u001d1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000l\ufffd\ufffd\\u001d1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002219877e557e740cecdf6970f8f5f7de7458c4c131\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000l\ufffd\ufffd\\u001d1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*l\ufffd\ufffd1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000l\ufffd\ufffd\\u001d1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*l\ufffd\ufffd1\ufffd\\\\L\ufffd$\\\\\u003E\ufffd\ufffdI\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053862,"ip":"178.44.116.194","ts":"2026-10-25 05:58:07.000000","proto":"tcp","src_port":60854,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.7103247525310765, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022cffb50f8aab14415f3746d2aea2b147a\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f943c3a4b1f294b627af0becf8ef3cddfe11c2e3\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\u003E\ufffd\ufffd\u0027\ufffdGM\ufffd\ufffdf\ufffd~q\ufffdR\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053861,"ip":"178.44.116.194","ts":"2026-10-25 05:58:06.000000","proto":"tcp","src_port":60826,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.638464247188912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002215e3ee40bfebb19f39167464e25e35ae\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\b\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\b\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\b\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\b\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\b\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229006cd662b70dbcb8426cbc2bef4df4d26b60737\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\b\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\b\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\ufffd$\ufffdeSN\ufffd\ufffdvx\ufffd\ufffd\u025b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053859,"ip":"178.44.116.194","ts":"2026-10-25 05:58:06.000000","proto":"tcp","src_port":60797,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.689048156786396, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229f0ddc891870ccb15e629fe817ae2be4\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222fd6b49eb18c9e9e46ad4a441585859b92a0559f\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffd|!E\ufffd\\\u0022\ufffd\ufffdcR\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053856,"ip":"178.44.116.194","ts":"2026-10-25 05:58:06.000000","proto":"tcp","src_port":60767,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.667771561041715, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a2268511427dc959ee79f14504b8d353\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\n\\u000f\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\n\\u000f\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\n\\u000f\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\n\\u000f\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\n\\u000f\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002289a68aed0d71afecb7dc9c8a550df47088b9bf48\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\n\\u000f\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\\n\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\n\\u000f\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\\n\ud84e\ude3a\ufffdI\ufffd\u00c0\ufffd:|\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053854,"ip":"178.44.116.194","ts":"2026-10-25 05:58:06.000000","proto":"tcp","src_port":60736,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.689048156786396, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022aba4864829d98ff7763d85d632407a79\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd`p\ufffdTj4J\ufffd\\u00138\ufffd\ufffd\\u0012\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd`p\ufffdTj4J\ufffd\\u00138\ufffd\ufffd\\u0012\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd`p\ufffdTj4J\ufffd\\u00138\ufffd\ufffd\\u0012\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd`p\ufffdTj4J\ufffd\\u00138\ufffd\ufffd\\u0012\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd`p\ufffdTj4J\ufffd\\u00138\ufffd\ufffd\\u0012\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b6095638d0ee058b2bf8e436e4ffd94872b8c6f3\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd`p\ufffdTj4J\ufffd\\u00138\ufffd\ufffd\\u0012\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd`p\ufffdTj4J\ufffd8\ufffd\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd`p\ufffdTj4J\ufffd\\u00138\ufffd\ufffd\\u0012\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd`p\ufffdTj4J\ufffd8\ufffd\ufffd\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053850,"ip":"178.44.116.194","ts":"2026-10-25 05:58:06.000000","proto":"tcp","src_port":60707,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.689048156786396, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fd3eb28e74cf188ece300fe224cfb6f7\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010x\ufffd\ufffd\ufffd\\u00127L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010x\ufffd\ufffd\ufffd\\u00127L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010x\ufffd\ufffd\ufffd\\u00127L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010x\ufffd\ufffd\ufffd\\u00127L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010x\ufffd\ufffd\ufffd\\u00127L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ecc29a90dd4b553befa47f92a39c4698aec5f9cc\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010x\ufffd\ufffd\ufffd\\u00127L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*x\ufffd\ufffd\ufffd7L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010x\ufffd\ufffd\ufffd\\u00127L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*x\ufffd\ufffd\ufffd7L\ufffdE\u07c3\ufffd\ufffd\ufffdi\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053849,"ip":"178.44.116.194","ts":"2026-10-25 05:58:06.000000","proto":"tcp","src_port":60688,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.7103247525310765, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f3ad876344996c1a7610a837026d8f36\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a02112954d51b98e115923141c36aafdf5d54c74\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*~\ufffd\ufffdN\ufffd\ufffdLO\ufffd\ufffd_oGq\ufffd\/\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053848,"ip":"178.44.116.194","ts":"2026-10-25 05:58:05.000000","proto":"tcp","src_port":60646,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.579849619483308, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dc266d28d82b480cc521c72bb1644bb0\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022579e885e4bee2b4856d247c2ab4694ed1f09ef60\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*n\ufffd?\ufffd*\/nN\ufffd1}\ufffd\u015d\ufffd%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053847,"ip":"178.44.116.194","ts":"2026-10-25 05:58:05.000000","proto":"tcp","src_port":60051,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.667771561041715, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022582ff44e3d65bf90e638bc5e70a5bdd2\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa77949c08b51e27ae21f8c6ac31874be450af90\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*L\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd7\ufffd\ufffd{D\ufffd0\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053845,"ip":"178.44.116.194","ts":"2026-10-25 05:58:05.000000","proto":"tcp","src_port":60024,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.638464247188912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fb9364368e75e7d665ac90cd6d9e7238\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022101f8f2f7c453dbe859be21e88efa55569b1773a\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\u4c9dUuJ;L\ufffd\ufffd_\ufffd1\ufffd\ufffd6\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053842,"ip":"178.44.116.194","ts":"2026-10-25 05:58:05.000000","proto":"tcp","src_port":60007,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.625218369552353, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229da64cf3b163f1bce847bfbea29c6e4b\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\\u0012\/\ufffd\\b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\\u0012\/\ufffd\\b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\\u0012\/\ufffd\\b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\\u0012\/\ufffd\\b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\\u0012\/\ufffd\\b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002251b29238a4098716370df75f78a15c6d49651650\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\\u0012\/\ufffd\\b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\/\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\\u0012\/\ufffd\\b\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*K\\n2\ufffdI%\ufffdH\ufffd.\ufffdX\/\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053841,"ip":"178.44.116.194","ts":"2026-10-25 05:58:05.000000","proto":"tcp","src_port":59971,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.667771561041715, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229959b2015b346e17aab02bcef6977492\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\\u0007\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\\u0007\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\\u0007\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\\u0007\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\\u0007\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225d56d0eac14aa950ca21ec6d25f356852f6db268\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\\u0007\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\\u0007\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*D \u05a7R\ufffd\ufffdJ\ufffd`\ufffd\ufffd0\ufffdS\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053837,"ip":"178.44.116.194","ts":"2026-10-25 05:58:05.000000","proto":"tcp","src_port":59945,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.731601348275758, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002225a4be452fb8d05afcc7ddbbd5742f75\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0019\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0019\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0019\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0019\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0019\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b8cdf22812df5bdc5c42d97be1853f585600c405\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0019\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0019\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\u003C \ufffdL\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053836,"ip":"178.44.116.194","ts":"2026-10-25 05:58:04.000000","proto":"tcp","src_port":59645,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.646494965297034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223b6959171c3f4071bd9f57e7147f50ba\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4\\u0011`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4\\u0011`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4\\u0011`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4\\u0011`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4\\u0011`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002246d693f0d07983808474747e7381edb1bf11e31f\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4\\u0011`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4\\u0011`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*,\u003C)\ufffd|\ufffd\u003CL\ufffdMp\ufffd4`j\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053834,"ip":"178.44.116.194","ts":"2026-10-25 05:58:04.000000","proto":"tcp","src_port":58782,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6758022791498375, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022faea4d8a03aad626fb77ea0768a54529\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\\u0022\ufffd\ufffd\\u0004\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd\\u0010[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\\u0022\ufffd\ufffd\\u0004\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd\\u0010[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\\u0022\ufffd\ufffd\\u0004\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd\\u0010[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\\u0022\ufffd\ufffd\\u0004\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd\\u0010[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\\u0022\ufffd\ufffd\\u0004\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd\\u0010[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ec575d0526efee86ac694e797adf5282a72fc976\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\\u0022\ufffd\ufffd\\u0004\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd\\u0010[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\\\u0022\ufffd\ufffd\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\\\u0022\ufffd\ufffd\\u0004\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd\\u0010[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\\\u0022\ufffd\ufffd\ufffd\\tF\ufffd\ufffdI\ufffda\ufffd[\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053832,"ip":"178.44.116.194","ts":"2026-10-25 05:58:04.000000","proto":"tcp","src_port":58762,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.667771561041715, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d69d6a5ccb915be1d0a2c1b01cf4a7cb\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdX\ufffd\\u0007\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdX\ufffd\\u0007\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdX\ufffd\\u0007\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdX\ufffd\\u0007\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdX\ufffd\\u0007\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e86bd760129417280887ff5614cf81cfb85f710b\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdX\ufffd\\u0007\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffdX\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffdX\ufffd\\u0007\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffdX\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd`\ufffdQ\ufffdU9\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053830,"ip":"178.44.116.194","ts":"2026-10-25 05:58:04.000000","proto":"tcp","src_port":58742,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.625218369552354, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002285264faaa65987071a0bcdb22dcae9b2\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010 ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010 ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010 ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010 ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010 ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d921c211c914f03d5b0b7caa67ad0aeb96a6c00b\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010 ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd* ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\\u0010 ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd* ;\ufffd \ufffdI\ufffd\u04b0\ufffd\ufffdk\ufffd\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":8053827,"ip":"178.44.116.194","ts":"2026-10-25 05:58:04.000000","proto":"tcp","src_port":58721,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.689048156786396, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 12389, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 12389, \u0022org\u0022: \u0022Rostelecom\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a53d8b27dc2eb27ef228253d48eb244e\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 21}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\u0015\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\u0015\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\u0015\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\u0015\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\u0015\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e5da98ec89e7b4003dd5c05152e9f983cb119101\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\u0015\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000*\\u001c\\u0000\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\u0015\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\\n\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\\\u0022\ufffd|%\ufffd=\ufffd1\ufffdI\ufffdM\ufffd4\ufffd9n\ufffdrb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 6 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94}],"total_events":2724}