19/07/2026 17:00:04 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
��PH_��Y ��;2�%C��r����"*Ms" ����p�Q��Á���CW���w�Q,���� *���,�+̩�0�/̨� � �� � � 5 /�� �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��PH_��Y ��;2�%C��r����"*Ms" ����p�Q��Á���CW���w�Q,���� *���,�+̩�0�/̨�
� �� � � 5 /��
�
Requête brute (extrait)
��PH_��Y ��;2�%C��r����"*Ms" ����p�Q��Á���CW���w�Q,���� *���,�+̩�0�/̨� � �� � � 5 /�� � � �� h2http/1.1 3 + )�� Q�l5UڞV������0��bT��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.9441659059339473,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a061c7ccaf55ed05abb00f7e7f7ebe5b",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdPH_\ufffd\ufffdY\t\ufffd\ufffd;2\ufffd%C\ufffd\u0016\ufffdr\ufffd\u0003\ufffd\u0006\ufffd\ufffd\"*M\u0011s\" \ufffd\u000f\ufffd\ufffd\ufffdp\ufffdQ\u001a\ufffd\ufffd\u00c1\ufffd\ufffd\ufffdCW\ufffd\ufffd\ufffdw\ufffd\u001bQ\u0011,\ufffd\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdPH_\ufffd\ufffdY\t\ufffd\ufffd;2\ufffd%C\ufffd\u0016\ufffdr\ufffd\u0003\ufffd\u0006\ufffd\ufffd\"*M\u0011s\" \ufffd\u000f\ufffd\ufffd\ufffdp\ufffdQ\u001a\ufffd\ufffd\u00c1\ufffd\ufffd\ufffdCW\ufffd\ufffd\ufffdw\ufffd\u001bQ\u0011,\ufffd\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 Q\ufffd\u0004l5U\u069eV\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00130\ufffd\ufffdbT\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdPH_\ufffd\ufffdY\t\ufffd\ufffd;2\ufffd%C\ufffd\u0016\ufffdr\ufffd\u0003\ufffd\u0006\ufffd\ufffd\"*M\u0011s\" \ufffd\u000f\ufffd\ufffd\ufffdp\ufffdQ\u001a\ufffd\ufffd\u00c1\ufffd\ufffd\ufffdCW\ufffd\ufffd\ufffdw\ufffd\u001bQ\u0011,\ufffd\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fefa9a435fb949125e6004a93fd0d0ae3421df55",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdPH_\ufffd\ufffdY\t\ufffd\ufffd;2\ufffd%C\ufffd\u0016\ufffdr\ufffd\u0003\ufffd\u0006\ufffd\ufffd\"*M\u0011s\" \ufffd\u000f\ufffd\ufffd\ufffdp\ufffdQ\u001a\ufffd\ufffd\u00c1\ufffd\ufffd\ufffdCW\ufffd\ufffd\ufffdw\ufffd\u001bQ\u0011,\ufffd\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffdPH_\ufffd\ufffdY\t\ufffd\ufffd;2\ufffd%C\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\"*Ms\" \ufffd\ufffd\ufffd\ufffdp\ufffdQ\ufffd\ufffd\u00c1\ufffd\ufffd\ufffdCW\ufffd\ufffd\ufffdw\ufffdQ,\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdPH_\ufffd\ufffdY\t\ufffd\ufffd;2\ufffd%C\ufffd\u0016\ufffdr\ufffd\u0003\ufffd\u0006\ufffd\ufffd\"*M\u0011s\" \ufffd\u000f\ufffd\ufffd\ufffdp\ufffdQ\u001a\ufffd\ufffd\u00c1\ufffd\ufffd\ufffdCW\ufffd\ufffd\ufffdw\ufffd\u001bQ\u0011,\ufffd\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdPH_\ufffd\ufffdY\t\ufffd\ufffd;2\ufffd%C\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\"*Ms\" \ufffd\ufffd\ufffd\ufffdp\ufffdQ\ufffd\ufffd\u00c1\ufffd\ufffd\ufffdCW\ufffd\ufffd\ufffdw\ufffdQ,\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 17:00:00 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde Kafka
kafka probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
���� �� g�C�0��&ͼ����'`w���s� ���r�RG���a{�4����&��F� TZ3w�! **�+�/�,�0̨̩�� � � / 5 ��� �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���� �� g�C�0��&ͼ����'`w���s� ���r�RG���a{�4����&��F� TZ3w�! **�+�/�,�0̨̩�� � � / 5 ��� �
Requête brute (extrait)
���� �� g�C�0��&ͼ����'`w���s� ���r�RG���a{�4����&��F� TZ3w�! **�+�/�,�0̨̩�� � � / 5 ��� � �� # h2http/1.1 3 + )�� �:�f��% >T�%4.�ʚ��J:��$��ϖL -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.787445213858028,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9e9c12eeca88e01f379b84ee6c332851",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0000\tg\ufffdC\ufffd0\ufffd\ufffd&\u037c\ufffd\ufffd\ufffd\ufffd'`w\ufffd\ufffd\ufffds\ufffd \ufffd\ufffd\ufffdr\ufffdRG\ufffd\ufffd\ufffda{\ufffd4\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffdF\ufffd\u001cT\u0015Z3w\ufffd!\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0000\tg\ufffdC\ufffd0\ufffd\ufffd&\u037c\ufffd\ufffd\ufffd\ufffd'`w\ufffd\ufffd\ufffds\ufffd \ufffd\ufffd\ufffdr\ufffdRG\ufffd\ufffd\ufffda{\ufffd4\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffdF\ufffd\u001cT\u0015Z3w\ufffd!\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd:\ufffdf\ufffd\ufffd%\u001f>T\ufffd%4.\ufffd\u029a\ufffd\ufffdJ\u0017:\ufffd\ufffd$\u001a\ufffd\ufffd\u03d6L \u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0000\tg\ufffdC\ufffd0\ufffd\ufffd&\u037c\ufffd\ufffd\ufffd\ufffd'`w\ufffd\ufffd\ufffds\ufffd \ufffd\ufffd\ufffdr\ufffdRG\ufffd\ufffd\ufffda{\ufffd4\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffdF\ufffd\u001cT\u0015Z3w\ufffd!\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d15b20ed265f9d0d400982f4609f2df0399c7ec",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0000\tg\ufffdC\ufffd0\ufffd\ufffd&\u037c\ufffd\ufffd\ufffd\ufffd'`w\ufffd\ufffd\ufffds\ufffd \ufffd\ufffd\ufffdr\ufffdRG\ufffd\ufffd\ufffda{\ufffd4\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffdF\ufffd\u001cT\u0015Z3w\ufffd!\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\tg\ufffdC\ufffd0\ufffd\ufffd&\u037c\ufffd\ufffd\ufffd\ufffd'`w\ufffd\ufffd\ufffds\ufffd \ufffd\ufffd\ufffdr\ufffdRG\ufffd\ufffd\ufffda{\ufffd4\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffdF\ufffdTZ3w\ufffd! **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u0000\tg\ufffdC\ufffd0\ufffd\ufffd&\u037c\ufffd\ufffd\ufffd\ufffd'`w\ufffd\ufffd\ufffds\ufffd \ufffd\ufffd\ufffdr\ufffdRG\ufffd\ufffd\ufffda{\ufffd4\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffdF\ufffd\u001cT\u0015Z3w\ufffd!\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\tg\ufffdC\ufffd0\ufffd\ufffd&\u037c\ufffd\ufffd\ufffd\ufffd'`w\ufffd\ufffd\ufffds\ufffd \ufffd\ufffd\ufffdr\ufffdRG\ufffd\ufffd\ufffda{\ufffd4\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffdF\ufffdTZ3w\ufffd! **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 16:59:50 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 575,
"payload_entropy": 5.5750064570157045,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "42d326e7a128f3e2655af6e0a1600b0c",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c99b1e677b72ad704f0d46da6bb1b6fde358208c",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 16:59:39 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 470,
"payload_entropy": 5.449921012042444,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "04c22a6f2f977457a3de09221d7f7819",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd22d414b4eb95f537dd22ab78af841d1e81a964",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 13:52:29 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde Kafka
kafka probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�1 B}W�� zu�FS��jX���*T�S���E�� h�m�.�s�L2'MXE����E��r�/�W{} zz�+�/�,�0̨̩�� � � / 5 ��� �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�1 B}W�� zu�FS��jX���*T�S���E�� h�m�.�s�L2'MXE����E��r�/�W{} zz�+�/�,�0̨̩�� � � / 5 ��� �
Requête brute (extrait)
�1 B}W�� zu�FS��jX���*T�S���E�� h�m�.�s�L2'MXE����E��r�/�W{} zz�+�/�,�0̨̩�� � � / 5 ��� � �� # h2http/1.1 3 + )�� L%b�,�E%ذ�]�T�w00;���hyJ����� -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.7857455891724934,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d70bf422951bec6131a5b85b9597e450",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\u0019\u001dB}W\ufffd\ufffd\tzu\ufffdFS\ufffd\ufffdjX\ufffd\ufffd\ufffd*T\ufffdS\ufffd\ufffd\ufffdE\u0003\ufffd\ufffd h\ufffdm\ufffd.\ufffds\u0018\ufffdL2'MXE\ufffd\ufffd\ufffd\ufffd\b\u0015E\ufffd\ufffdr\ufffd\/\ufffdW{}\u001d\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\u0019\u001dB}W\ufffd\ufffd\tzu\ufffdFS\ufffd\ufffdjX\ufffd\ufffd\ufffd*T\ufffdS\ufffd\ufffd\ufffdE\u0003\ufffd\ufffd h\ufffdm\ufffd.\ufffds\u0018\ufffdL2'MXE\ufffd\ufffd\ufffd\ufffd\b\u0015E\ufffd\ufffdr\ufffd\/\ufffdW{}\u001d\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 L%b\ufffd,\ufffdE%\u0630\ufffd]\ufffdT\ufffdw00;\ufffd\ufffd\ufffd\u000ehyJ\ufffd\ufffd\ufffd\ufffd\ufffd\n\u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\u0019\u001dB}W\ufffd\ufffd\tzu\ufffdFS\ufffd\ufffdjX\ufffd\ufffd\ufffd*T\ufffdS\ufffd\ufffd\ufffdE\u0003\ufffd\ufffd h\ufffdm\ufffd.\ufffds\u0018\ufffdL2'MXE\ufffd\ufffd\ufffd\ufffd\b\u0015E\ufffd\ufffdr\ufffd\/\ufffdW{}\u001d\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "066a2d18791f50c6d718749a680d48df1f73b7b2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\u0019\u001dB}W\ufffd\ufffd\tzu\ufffdFS\ufffd\ufffdjX\ufffd\ufffd\ufffd*T\ufffdS\ufffd\ufffd\ufffdE\u0003\ufffd\ufffd h\ufffdm\ufffd.\ufffds\u0018\ufffdL2'MXE\ufffd\ufffd\ufffd\ufffd\b\u0015E\ufffd\ufffdr\ufffd\/\ufffdW{}\u001d\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd1B}W\ufffd\ufffd\tzu\ufffdFS\ufffd\ufffdjX\ufffd\ufffd\ufffd*T\ufffdS\ufffd\ufffd\ufffdE\ufffd\ufffd h\ufffdm\ufffd.\ufffds\ufffdL2'MXE\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdr\ufffd\/\ufffdW{} zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\u0019\u001dB}W\ufffd\ufffd\tzu\ufffdFS\ufffd\ufffdjX\ufffd\ufffd\ufffd*T\ufffdS\ufffd\ufffd\ufffdE\u0003\ufffd\ufffd h\ufffdm\ufffd.\ufffds\u0018\ufffdL2'MXE\ufffd\ufffd\ufffd\ufffd\b\u0015E\ufffd\ufffdr\ufffd\/\ufffdW{}\u001d\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd1B}W\ufffd\ufffd\tzu\ufffdFS\ufffd\ufffdjX\ufffd\ufffd\ufffd*T\ufffdS\ufffd\ufffd\ufffdE\ufffd\ufffd h\ufffdm\ufffd.\ufffds\ufffdL2'MXE\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdr\ufffd\/\ufffdW{} zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 13:52:27 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�y8dB0I��GMt�x� 6��휌�52p-N� kh�A4ܥĽ��*��-�>Ԟ�b�L��Hu��� *���,�+̩�0�/̨� � �� � � 5 /�� ���
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�y8dB0I��GMt�x� 6��휌�52p-N�
kh�A4ܥĽ��*��-�>Ԟ�b�L��Hu��� *���,�+̩�0�/̨�
� �� � � 5 /��
���
Requête brute (extrait)
�y8dB0I��GMt�x� 6��휌�52p-N� kh�A4ܥĽ��*��-�>Ԟ�b�L��Hu��� *���,�+̩�0�/̨� � �� � � 5 /�� ��� � �� h2http/1.1 3 + )�� 9y��Y���%���� Տ�i�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.919964255311946,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "427b2a37c3477950deaf8fe264333d3a",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y8dB0I\ufffd\ufffdG\u000eMt\ufffdx\ufffd\u000b\u00136\b\ufffd\ufffd\ud70c\ufffd52p-N\ufffd \rkh\ufffdA4\u0725\u013d\ufffd\ufffd*\ufffd\ufffd-\ufffd>\u051e\ufffdb\ufffdL\ufffd\u0007\ufffdHu\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y8dB0I\ufffd\ufffdG\u000eMt\ufffdx\ufffd\u000b\u00136\b\ufffd\ufffd\ud70c\ufffd52p-N\ufffd \rkh\ufffdA4\u0725\u013d\ufffd\ufffd*\ufffd\ufffd-\ufffd>\u051e\ufffdb\ufffdL\ufffd\u0007\ufffdHu\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 9y\ufffd\ufffdY\ufffd\ufffd\ufffd%\u0002\ufffd\ufffd\ufffd\ufffd\u0018\u001d\u001b\u054f\ufffdi\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y8dB0I\ufffd\ufffdG\u000eMt\ufffdx\ufffd\u000b\u00136\b\ufffd\ufffd\ud70c\ufffd52p-N\ufffd \rkh\ufffdA4\u0725\u013d\ufffd\ufffd*\ufffd\ufffd-\ufffd>\u051e\ufffdb\ufffdL\ufffd\u0007\ufffdHu\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3bc861c322c30ff0430e85c773493a530d62092f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y8dB0I\ufffd\ufffdG\u000eMt\ufffdx\ufffd\u000b\u00136\b\ufffd\ufffd\ud70c\ufffd52p-N\ufffd \rkh\ufffdA4\u0725\u013d\ufffd\ufffd*\ufffd\ufffd-\ufffd>\u051e\ufffdb\ufffdL\ufffd\u0007\ufffdHu\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffdy8dB0I\ufffd\ufffdGMt\ufffdx\ufffd6\ufffd\ufffd\ud70c\ufffd52p-N\ufffd \rkh\ufffdA4\u0725\u013d\ufffd\ufffd*\ufffd\ufffd-\ufffd>\u051e\ufffdb\ufffdL\ufffd\ufffdHu\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y8dB0I\ufffd\ufffdG\u000eMt\ufffdx\ufffd\u000b\u00136\b\ufffd\ufffd\ud70c\ufffd52p-N\ufffd \rkh\ufffdA4\u0725\u013d\ufffd\ufffd*\ufffd\ufffd-\ufffd>\u051e\ufffdb\ufffdL\ufffd\u0007\ufffdHu\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdy8dB0I\ufffd\ufffdGMt\ufffdx\ufffd6\ufffd\ufffd\ud70c\ufffd52p-N\ufffd \rkh\ufffdA4\u0725\u013d\ufffd\ufffd*\ufffd\ufffd-\ufffd>\u051e\ufffdb\ufffdL\ufffd\ufffdHu\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 13:52:25 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,imag
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 598,
"payload_entropy": 5.5736594571092555,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a793acaf162fe7ca8d54b61c3b758607",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,imag",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,imag",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "010ef6df5778750d5b6bd2705e5a79d94db3a446",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 13:52:23 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-E
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 429,
"payload_entropy": 5.420249102093711,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "550e231b9dd63df3aa24e5b8f1cffe2c",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-E",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-E",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98d9aecb082774d887606effd37c3e97ca5dd37d",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 11:30:00 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
z v,������CR���㾆(�7]LF�D5�ڡ$! ���A�¸$���Mw](l�u"? �]���� "�+�/̨̩�,�0� � �� � � / 5 �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
z v,������CR���㾆(�7]LF�D5�ڡ$! ���A�¸$���Mw](l�u"? �]���� "�+�/̨̩�,�0�
� �� � � / 5 �
Requête brute (extrait)
z v,������CR���㾆(�7]LF�D5�ڡ$! ���A�¸$���Mw](l�u"? �]���� "�+�/̨̩�,�0� � �� � � / 5 � # h2http/1.1 " 3 k i ����@ޖ���X��Ꭾ*P���1�\��X A��j�3u��>qy���b
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 639,
"payload_entropy": 7.150717221377634,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cef9dcfff9baf2b10d8183bada5e55ab",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdCR\ufffd\ufffd\ufffd\u3f86(\ufffd7]\u0011LF\ufffdD5\ufffd\u06a1\b$! \u0013\ufffd\ufffd\ufffdA\ufffd\u0003\u00b8$\ufffd\ufffd\ufffdMw](l\ufffdu\"?\b\u001c\u001f\ufffd]\ufffd\ufffd\ufffd\ufffd\u001a\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdCR\ufffd\ufffd\ufffd\u3f86(\ufffd7]\u0011LF\ufffdD5\ufffd\u06a1\b$! \u0013\ufffd\ufffd\ufffdA\ufffd\u0003\u00b8$\ufffd\ufffd\ufffdMw](l\ufffdu\"?\b\u001c\u001f\ufffd]\ufffd\ufffd\ufffd\ufffd\u001a\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd@\u0796\ufffd\ufffd\ufffdX\ufffd\ufffd\u0016\u13ae*P\u0010\ufffd\ufffd\ufffd1\ufffd\\\ufffd\ufffdX\u0000\u0017\u0000A\u0004\ufffd\ufffdj\ufffd3u\ufffd\ufffd>qy\ufffd\ufffd\ufffdb",
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdCR\ufffd\ufffd\ufffd\u3f86(\ufffd7]\u0011LF\ufffdD5\ufffd\u06a1\b$! \u0013\ufffd\ufffd\ufffdA\ufffd\u0003\u00b8$\ufffd\ufffd\ufffdMw](l\ufffdu\"?\b\u001c\u001f\ufffd]\ufffd\ufffd\ufffd\ufffd\u001a\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14ef5fe69049ea5f571e9be95f231263364ee6ce",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdCR\ufffd\ufffd\ufffd\u3f86(\ufffd7]\u0011LF\ufffdD5\ufffd\u06a1\b$! \u0013\ufffd\ufffd\ufffdA\ufffd\u0003\u00b8$\ufffd\ufffd\ufffdMw](l\ufffdu\"?\b\u001c\u001f\ufffd]\ufffd\ufffd\ufffd\ufffd\u001a\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "zv,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdCR\ufffd\ufffd\ufffd\u3f86(\ufffd7]LF\ufffdD5\ufffd\u06a1$! \ufffd\ufffd\ufffdA\ufffd\u00b8$\ufffd\ufffd\ufffdMw](l\ufffdu\"?\ufffd]\ufffd\ufffd\ufffd\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003,\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdCR\ufffd\ufffd\ufffd\u3f86(\ufffd7]\u0011LF\ufffdD5\ufffd\u06a1\b$! \u0013\ufffd\ufffd\ufffdA\ufffd\u0003\u00b8$\ufffd\ufffd\ufffdMw](l\ufffdu\"?\b\u001c\u001f\ufffd]\ufffd\ufffd\ufffd\ufffd\u001a\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "zv,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdCR\ufffd\ufffd\ufffd\u3f86(\ufffd7]LF\ufffdD5\ufffd\u06a1$! \ufffd\ufffd\ufffdA\ufffd\u00b8$\ufffd\ufffd\ufffdMw](l\ufffdu\"?\ufffd]\ufffd\ufffd\ufffd\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 11:29:57 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Encoding: gzip, def
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 411,
"payload_entropy": 5.425455084191482,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4cc017072399243e3434288c7de3318a",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encoding: gzip, def",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encoding: gzip, def",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f4d956b955d0c72500cdbf3214219fdba60381b",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 11:29:50 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Ma
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Ma
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1 Accept: text/html,application/xhtml+xm
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 488,
"payload_entropy": 5.475608510980939,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0af60f19ffa108c97cb5db3440d168a",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Ma",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Mobile\/15E148 Safari\/604.1\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Ma",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Mobile\/15E148 Safari\/604.1\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Ma",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2736a5de95e1089dc0fa3d9319765342dedb8d5",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Ma",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Ma",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Ma",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Ma",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 07:15:20 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
� �4² ���[Ӱ� ��1�ڇ@ō��w�=�:� �b�Y�֠`��[u:�:z#�!��ϲ�K � JJ�+�/�,�0̨̩�� � � / 5 S�� � � �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �4²
���[Ӱ� ��1�ڇ@ō��w�=�:� �b�Y�֠`��[u:�:z#�!��ϲ�K
� JJ�+�/�,�0̨̩�� � � / 5 S�� �
� �
Requête brute (extrait)
� �4² ���[Ӱ� ��1�ڇ@ō��w�=�:� �b�Y�֠`��[u:�:z#�!��ϲ�K � JJ�+�/�,�0̨̩�� � � / 5 S�� � � � ] �e�9��� z � t��'s��k! �!��h�,���Q�識xZ$Z�{� BK��E���f�h�P�(�j�=� U�R� �gЉ�o�[�.BE��V��<e�6\ �T �w�&
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 1733,
"payload_entropy": 7.7582841511558644,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0936703290a05d3aa82d0057366c6f85",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\u00b2\n\ufffd\ufffd\ufffd[\u0001\u04f0\ufffd\t\ufffd\ufffd1\ufffd\u0687@\u014d\ufffd\ufffdw\ufffd\u0003=\ufffd:\ufffd \ufffdb\ufffdY\ufffd\u05a0`\ufffd\u0010\ufffd[\u0018u:\ufffd:z#\ufffd!\ufffd\ufffd\u0006\u0011\u03f2\ufffdK\n\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\u00b2\n\ufffd\ufffd\ufffd[\u0001\u04f0\ufffd\t\ufffd\ufffd1\ufffd\u0687@\u014d\ufffd\ufffdw\ufffd\u0003=\ufffd:\ufffd \ufffdb\ufffdY\ufffd\u05a0`\ufffd\u0010\ufffd[\u0018u:\ufffd:z#\ufffd!\ufffd\ufffd\u0006\u0011\u03f2\ufffdK\n\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 ]\u0011\f\ufffde\ufffd\u00159\ufffd\ufffd\ufffd\u0000z\u0007\f\u0001\u001e\ufffd\u001f\u0002t\u0006\ufffd\ufffd's\ufffd\ufffdk!\u0000\ufffd!\ufffd\ufffdh\ufffd,\u000f\ufffd\ufffd\ufffdQ\ufffd\uf9fcxZ$Z\u0011\ufffd{\ufffd\tBK\ufffd\ufffdE\ufffd\ufffd\ufffdf\ufffdh\ufffdP\ufffd(\ufffdj\ufffd=\u0016\u0018\ufffd\rU\u0011\ufffd\u0006\u0004R\ufffd\u001e\ufffdg\u0409\ufffdo\ufffd[\ufffd.BE\ufffd\ufffdV\ufffd\ufffd<\u000fe\ufffd6\u001b\\\u0000\ufffdT\u0000\ufffdw\ufffd&",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\u00b2\n\ufffd\ufffd\ufffd[\u0001\u04f0\ufffd\t\ufffd\ufffd1\ufffd\u0687@\u014d\ufffd\ufffdw\ufffd\u0003=\ufffd:\ufffd \ufffdb\ufffdY\ufffd\u05a0`\ufffd\u0010\ufffd[\u0018u:\ufffd:z#\ufffd!\ufffd\ufffd\u0006\u0011\u03f2\ufffdK\n\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "954695d4798a178722e9f2687835d95e49733ff8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\u00b2\n\ufffd\ufffd\ufffd[\u0001\u04f0\ufffd\t\ufffd\ufffd1\ufffd\u0687@\u014d\ufffd\ufffdw\ufffd\u0003=\ufffd:\ufffd \ufffdb\ufffdY\ufffd\u05a0`\ufffd\u0010\ufffd[\u0018u:\ufffd:z#\ufffd!\ufffd\ufffd\u0006\u0011\u03f2\ufffdK\n\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffd4\u00b2\n\ufffd\ufffd\ufffd[\u04f0\ufffd\t\ufffd\ufffd1\ufffd\u0687@\u014d\ufffd\ufffdw\ufffd=\ufffd:\ufffd \ufffdb\ufffdY\ufffd\u05a0`\ufffd\ufffd[u:\ufffd:z#\ufffd!\ufffd\ufffd\u03f2\ufffdK\n\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5S\ufffd\ufffd\ufffd\r\ufffd\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\u00b2\n\ufffd\ufffd\ufffd[\u0001\u04f0\ufffd\t\ufffd\ufffd1\ufffd\u0687@\u014d\ufffd\ufffdw\ufffd\u0003=\ufffd:\ufffd \ufffdb\ufffdY\ufffd\u05a0`\ufffd\u0010\ufffd[\u0018u:\ufffd:z#\ufffd!\ufffd\ufffd\u0006\u0011\u03f2\ufffdK\n\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd4\u00b2\n\ufffd\ufffd\ufffd[\u04f0\ufffd\t\ufffd\ufffd1\ufffd\u0687@\u014d\ufffd\ufffdw\ufffd=\ufffd:\ufffd \ufffdb\ufffdY\ufffd\u05a0`\ufffd\ufffd[u:\ufffd:z#\ufffd!\ufffd\ufffd\u03f2\ufffdK\n\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5S\ufffd\ufffd\ufffd\r\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 07:15:17 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�aN�d��;��š`ث;�y�x�)ku�=$ �z����)Q� (��!��d$�:y���2݀�� *jj�,�+̩�0�/̨� � �� � � 5 /�� ���
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�aN�d��;��š`ث;�y�x�)ku�=$ �z����)Q� (��!��d$�:y���2݀�� *jj�,�+̩�0�/̨�
� �� � � 5 /��
���
Requête brute (extrait)
�aN�d��;��š`ث;�y�x�)ku�=$ �z����)Q� (��!��d$�:y���2݀�� *jj�,�+̩�0�/̨� � �� � � 5 /�� ��� � zz h2http/1.1 3 + )zz _� ���tZ]*�"E �-�n:l�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.9438854776315955,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "121c842cf018d062d6603ae771d7d496",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003aN\u0016\ufffdd\ufffd\ufffd;\ufffd\ufffd\u0161`\u062b;\ufffdy\ufffd\bx\ufffd)ku\ufffd=$\u0013 \ufffdz\ufffd\ufffd\ufffd\ufffd\b)Q\ufffd\u001c(\ufffd\ufffd!\ufffd\ufffdd$\ufffd:y\ufffd\ufffd\ufffd\u00152\u0740\ufffd\ufffd\u0000*jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003aN\u0016\ufffdd\ufffd\ufffd;\ufffd\ufffd\u0161`\u062b;\ufffdy\ufffd\bx\ufffd)ku\ufffd=$\u0013 \ufffdz\ufffd\ufffd\ufffd\ufffd\b)Q\ufffd\u001c(\ufffd\ufffd!\ufffd\ufffdd$\ufffd:y\ufffd\ufffd\ufffd\u00152\u0740\ufffd\ufffd\u0000*jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\nzz\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)zz\u0000\u0001\u0000\u0000\u001d\u0000 _\ufffd\t\ufffd\ufffd\ufffdt\bZ]*\ufffd\"E\u001e\ufffd-\ufffdn:l\ufffd\u0010",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003aN\u0016\ufffdd\ufffd\ufffd;\ufffd\ufffd\u0161`\u062b;\ufffdy\ufffd\bx\ufffd)ku\ufffd=$\u0013 \ufffdz\ufffd\ufffd\ufffd\ufffd\b)Q\ufffd\u001c(\ufffd\ufffd!\ufffd\ufffdd$\ufffd:y\ufffd\ufffd\ufffd\u00152\u0740\ufffd\ufffd\u0000*jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d10f50cc693ed50938a8efabda9f81ddf5f3a7a9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003aN\u0016\ufffdd\ufffd\ufffd;\ufffd\ufffd\u0161`\u062b;\ufffdy\ufffd\bx\ufffd)ku\ufffd=$\u0013 \ufffdz\ufffd\ufffd\ufffd\ufffd\b)Q\ufffd\u001c(\ufffd\ufffd!\ufffd\ufffdd$\ufffd:y\ufffd\ufffd\ufffd\u00152\u0740\ufffd\ufffd\u0000*jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffdaN\ufffdd\ufffd\ufffd;\ufffd\ufffd\u0161`\u062b;\ufffdy\ufffdx\ufffd)ku\ufffd=$ \ufffdz\ufffd\ufffd\ufffd\ufffd)Q\ufffd(\ufffd\ufffd!\ufffd\ufffdd$\ufffd:y\ufffd\ufffd\ufffd2\u0740\ufffd\ufffd*jj\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003aN\u0016\ufffdd\ufffd\ufffd;\ufffd\ufffd\u0161`\u062b;\ufffdy\ufffd\bx\ufffd)ku\ufffd=$\u0013 \ufffdz\ufffd\ufffd\ufffd\ufffd\b)Q\ufffd\u001c(\ufffd\ufffd!\ufffd\ufffdd$\ufffd:y\ufffd\ufffd\ufffd\u00152\u0740\ufffd\ufffd\u0000*jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdaN\ufffdd\ufffd\ufffd;\ufffd\ufffd\u0161`\u062b;\ufffdy\ufffdx\ufffd)ku\ufffd=$ \ufffdz\ufffd\ufffd\ufffd\ufffd)Q\ufffd(\ufffd\ufffd!\ufffd\ufffdd$\ufffd:y\ufffd\ufffd\ufffd2\u0740\ufffd\ufffd*jj\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 07:15:15 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 571,
"payload_entropy": 5.577793389100288,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 42366,
"country": "DE",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "23b56eaff7498f14ed367d991deca8cf",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f34c977cccac79faf473a45b92e528364440c42",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}