Fiche IP

Pays-Bas

192.253.248.251

Activité suspecte — risque 50/100 (Moyen) — MITRE TA0007 — confiance 100 % — multi-protocole (4 protocoles · 5 min)

FAI Limited Network LTD Première vue 11/10/2026 17:42 UTC Dernière vue 14/10/2026 07:42 UTC Risque Moyen

Période 2026-10-07 → 2026-10-14

Moyen 50/100

24h 7j 30j 90j

Synthèse

Score de risque max. 50/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 11/10/2026 17:42 UTC

Dernière observation 14/10/2026 07:42 UTC

Événements (période) 535

MITRE ATT&CK principal TA0007 525 occurrences

Pourquoi listée

Type « rdp_probe » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

50/100 Confiance 100 % 535 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC

Note de ticket

IP 192.253.248.251
Décision : Investiguer
Score max : 50/100 (Moyen)
Confiance : 100 %
Période : 2026-10-07 → 2026-10-14 · 535 événements
Motif : Type « rdp_probe » (signaux protocolaires) · confiance 100%
DNSBL : 251.248.253.192.dnsbl.blacklistip.com → 127.0.0.3 (Sonde RDP)
MITRE : TA0007
FAI : Limited Network LTD · Pays-Bas

Comparaison ASN / FAI

ASN 213790 · 192.253.248.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 535 événements sur la période pour cette IP.

77.90.185.243 Sonde fichier configuration 14/10/2026 11:40 UTC
77.90.185.244 Sonde fichier configuration 14/10/2026 11:30 UTC
172.94.9.88 Sonde SMTP (25/TCP) 14/10/2026 11:12 UTC
185.93.89.39 Tentative d'exploit 14/10/2026 10:17 UTC
185.93.89.37 Tentative d'exploit 14/10/2026 02:22 UTC
77.90.185.79 Sonde Litecoin 14/10/2026 00:26 UTC
185.93.89.42 Tentative d'exploit 13/10/2026 22:46 UTC
185.93.89.135 Sonde PostgreSQL 13/10/2026 18:19 UTC

Événements (filtres)

535

Première observation

11/10/2026 17:42 UTC

Dernière observation

14/10/2026 07:42 UTC

Dernière activité (filtres)

14/10/2026 07:42 UTC

Événements 7j

535

Ports distincts (7j)

327

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

SAP Diag TCP 5 SAP MS TCP 5 WEBLOGIC CLUSTER TCP 2 POSTGRES TCP 2 IRC TCP 2 X11 3 TCP 2 HTTP ALT 8007 TCP 2 HTTPS ALT 8444 TCP 2 HTTP ALT 8880 TCP 2 HTTP ALT 8006 TCP 1 DOCKER SWARM TCP 1 HTTP ALT 8060 TCP 1 ELASTICSEARCH TCP 1 MQTT WSS TCP 1 IOT PROBE TCP 1 KAFKA SSL TCP 1 GLASSFISH ADMIN TCP 1

SAP Diag

SAP MS

WEBLOGIC CLUSTER

POSTGRES

IRC

X11 3

Géolocalisation

Origine réseau déclarée

Pays-Bas unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Limited Network LTD 0 Port 3012 Sonde RDP

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

rdp probe · port 3012 · (sonde / probe)

Détails protocole

Aperçu payload

/*�Cookie: mstshash=Administr

Port / service

3012

Raison confiance

Confiance 100 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0347 pat-0348

Confiance

100% Corrélation +8

Famille de menace

scanner IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

535 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

535 événement(s) — page 3/22

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/10/2026 05:06:45 UTC	TCP	24623	—	Sonde RDP rdp probe · port 24623 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 24623 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":24623,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.4,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"bc8f77c7255636b94f9903c1c968d5a7f0304310","event_fingerprint":"5765a4062c1fc03c5219718fd68a88c67aee6daa","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd…
14/10/2026 05:01:29 UTC	TCP	5680	—	Sonde RDP rdp probe · port 5680 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5680 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":5680,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"7d4c9ff0a86487503730ca8dfe965652481894a3","event_fingerprint":"fe0eb511a0dbf3dab61d6e4700ebaf3dc9b7e0fe","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd7…
14/10/2026 04:53:05 UTC	TCP	1008	—	Sonde RDP rdp probe · port 1008 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1008 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"well_known","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":1008,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"dc42fd49dbd04abc9d722f2edf2157746633dcfb","event_fingerprint":"87a9ce4174728fcececd052e23c699dcc2228aad","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","pa…
14/10/2026 04:52:29 UTC	TCP	6033	—	Sonde RDP rdp probe · port 6033 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6033 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":6033,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"8e27f15e3e21d606a26be18ada68e4db37f6acff","event_fingerprint":"d38eb59ee089d0e4eea9f02ff64959fce4acfc82","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd788…
14/10/2026 04:41:11 UTC	TCP	23522	—	Sonde RDP rdp probe · port 23522 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 23522 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":23522,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"78c4ed5d83c358a611021274e7c6d7ddcee96475","event_fingerprint":"e5122d4723d118557b3960b6be4b9987968eed3c","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd…
14/10/2026 04:26:44 UTC	TCP	9888	—	Sonde RDP rdp probe · port 9888 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9888 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":9888,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"70e96a94646fb5d39112ee61c0b3b71f0ef2fc95","event_fingerprint":"cc1b548613e2a157023f5d12d22e8b8e45e82a47","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd7…
14/10/2026 04:17:24 UTC	TCP	21653	—	Sonde RDP rdp probe · port 21653 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21653 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":21653,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"d02cd196e1bc1110f1a058ea85836596b0f40f36","event_fingerprint":"934f5cecd40d4d5b45f1e4192616c680a87cb1bd","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd…
14/10/2026 03:53:41 UTC	TCP	8023	—	Sonde RDP rdp probe · port 8023 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8023 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":8023,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"bc4459c3b1df533d4921bb245861ba3659f25ddd","event_fingerprint":"fc536e09bdbac7717afaeb0b369039edfb4a9e3c","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd788…
14/10/2026 03:47:44 UTC	TCP	29355	—	Sonde RDP rdp probe · port 29355 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 29355 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":29355,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"49bfbd1ede5641449fe7ffd2bbc1f8628cb0d6fb","event_fingerprint":"323c4aead964a2c2c921ea8603f59588c9747a73","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","p…
14/10/2026 03:46:57 UTC	TCP	1200	—	Sonde RDP rdp probe · port 1200 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1200 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":1200,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.5,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"7b4cbf03b7a4ca4eb026d174486e1e3b356d1a4c","event_fingerprint":"16b3652c799a5e05693a1655b5e5f04b0e57a6e3","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","pa…
14/10/2026 03:42:05 UTC	TCP	4080	—	Sonde RDP rdp probe · port 4080 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4080 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":4080,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"16bd90227385e3f58bdb4a25f3e303b47e92376e","event_fingerprint":"d7b8ec1e0c85308bea70458dd3cfbbaca34244f4","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path…
14/10/2026 03:41:01 UTC	TCP	3004	—	Scan de ports port scan syn · port 3004 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3004 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":3004,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"38387d34def31c20369a43df565e46484d1f7a30","event_fingerprint":"da7618c34f148bf764b58708b7609e7acfaf4242","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor…
14/10/2026 03:40:40 UTC	TCP	3215 · SAP Diag	sap-diag	Sonde RDP rdp probe · via SAP Diag:3215 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-DIAG WAF — Recommandation Investiguer Tags net_sap_diag_probe sap_diag_emulated sap_diag_payload sap_diag_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3215 Chemin / cible — Service SAP Diag Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"protocol_emulated":true,"emulator_response":"00000000534150000000000000000000000000","emulator_response_len":19,"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":"sap-diag","app_proto":"sap-diag","asn":213790,"country":"NL","dst_port":3215,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":38,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":38,"novelty":0},"risk_score":50,"tag_count":4,"anomaly_count":0,"campaign_key":"7ee20d212276629bc7ccc097af7ede43b9ed8757","event_fingerprint":"e09b16a0683e160ce73648693d12113c8a54ecf6","classification_reason":"Connexion SAP Diag\/GUI \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":38,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"service_name":"sap-diag","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited…
14/10/2026 03:40:08 UTC	TCP	6970	—	Sonde RDP rdp probe · port 6970 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6970 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":6970,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"79d62bb92f904b95937f7a762f81d58c728744d6","event_fingerprint":"7525223c0f3e1d2d6a4714842b37332056f9faec","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","pa…
14/10/2026 03:37:31 UTC	TCP	4839	—	Sonde RDP rdp probe · port 4839 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4839 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":4839,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"a97bf62eb9c06d65f9e2bb98b8b49f0ae4beeea1","event_fingerprint":"eaaf5150a81dbea839066ca98bdfe9b337a48deb","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","pa…
14/10/2026 03:37:11 UTC	TCP	1975	—	Sonde RDP rdp probe · port 1975 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1975 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":1975,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.5,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"98db936751491705ea279ceee9a5d39d968e934c","event_fingerprint":"65f96b68cc7fd2e5a483f92a45eccd610d29e34a","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","pa…
14/10/2026 03:34:56 UTC	TCP	29215	—	Sonde RDP rdp probe · port 29215 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 29215 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":29215,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"ecc7d5546689cf844b17ec90fb38773215729800","event_fingerprint":"ba026d89d4ee32d1fea1677c7a61027719a94e0b","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","p…
14/10/2026 03:31:56 UTC	TCP	8007 · HTTP ALT 8007	http-alt-8007	Sonde RDP rdp probe · via HTTP ALT 8007:8007 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8007 WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8007 Chemin / cible — Service HTTP ALT 8007 Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":"http-alt-8007","app_proto":"http-alt-8007","asn":213790,"country":"NL","dst_port":8007,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.4,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"faf3bb25fda20272f0dd595d0da1d7e5897c6e9b","event_fingerprint":"692f53580325b63a01b22145d98c031d02468b53","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":…
14/10/2026 03:18:28 UTC	TCP	29999	—	Sonde RDP rdp probe · port 29999 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 29999 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":29999,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.5,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"53a09544d43f76d59affbaa73375a983de343de1","event_fingerprint":"88028e24888e9964e29c647d07cd0892077eeffd","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"5dd…
14/10/2026 03:12:34 UTC	TCP	3184	—	Sonde RDP rdp probe · port 3184 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3184 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":3184,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.5,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"0ef620ab557ca26688b8410f70607ff9108ffa6a","event_fingerprint":"7aa28d094754c6abb2e5cc4190b95ca299bcb5dd","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","pa…
14/10/2026 03:11:11 UTC	TCP	21589	—	Sonde RDP rdp probe · port 21589 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21589 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":21589,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"265e459f1d5036f332daa79b14bb04195e0c4db9","event_fingerprint":"eec1048fcf5bbb6c46ca6e62b54e7126e9cebefd","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","p…
14/10/2026 03:08:27 UTC	TCP	2145	—	Sonde RDP rdp probe · port 2145 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2145 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":2145,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"5a99d731e3339ffc62f56399268162041c18fee7","event_fingerprint":"de2f47a81a0091a076991517bbaa88bcce3b0092","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path…
14/10/2026 03:06:36 UTC	TCP	8006 · HTTP ALT 8006	http-alt-8006	Sonde RDP rdp probe · via HTTP ALT 8006:8006 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8006 WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8006 Chemin / cible — Service HTTP ALT 8006 Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":"http-alt-8006","app_proto":"http-alt-8006","asn":213790,"country":"NL","dst_port":8006,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.3,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"212b28f4f85822fe6f1ee282dd44ed9495859305","event_fingerprint":"00d697c254771f5226ad267b8c9878930077e528","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped"…
14/10/2026 03:02:36 UTC	TCP	6250	—	Sonde RDP rdp probe · port 6250 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6250 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":6250,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"b923515b4748daf2da3f3f6c10c13fab3cbb1c13","event_fingerprint":"03c93318d67a8bd7b38046cbb978bb1446762496","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path…
14/10/2026 03:01:18 UTC	TCP	10060	—	Sonde RDP rdp probe · port 10060 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10060 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Limited Network LTD","service":null,"app_proto":null,"asn":213790,"country":"NL","dst_port":10060,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":50,"tag_count":0,"anomaly_count":0,"campaign_key":"f72805a15441dbdefb50b6a4b53c46edc0a0b2f7","event_fingerprint":"e31332acda73a74092fbe7a85820ceba4fdcb713","classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0347","pat-0348"],"kb_rule_ids":["pat-0347","pat-0348"],"matched_patterns":["pat-0347","pat-0348","pat-0868","pat-0554"],"matched_pattern_names":["RDP NTLM hash","RDP TPKT header","ET H.323 setup","Minecraft varint handshake"],"pattern_ids":["pat-0347","pat-0348","pat-0868","pat-0554"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":213790,"org":"Limited Network LTD","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","p…

192.253.248.251

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence