Détails IP 193.142.146.219

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous

Période

Protocole

Port (dst)

Service

Classification

Réinitialiser

Chronologie des événements

2210 événement(s) — page 1/45

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
07/06/2026 19:07:57 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ], "behavior_alert_count": 1, "behavior_priority": 72 }
07/06/2026 19:07:42 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:07:31 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:07:17 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:07:06 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:06:52 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:06:41 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:06:26 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:06:16 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:06:01 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:05:51 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ], "behavior_alert_count": 1, "behavior_priority": 84 }
07/06/2026 19:05:36 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:05:26 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:05:12 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:05:01 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:04:47 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:04:37 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:04:22 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:04:11 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:03:57 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:03:47 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:03:32 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:03:24 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:03:08 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:02:57 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:02:43 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ], "behavior_alert_count": 1, "behavior_priority": 72 }
07/06/2026 19:02:33 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:02:18 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:02:08 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:01:54 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:01:44 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:01:30 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:01:20 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:01:05 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:00:56 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:00:41 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ], "behavior_alert_count": 1, "behavior_priority": 84 }
07/06/2026 19:00:31 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:00:16 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 19:00:07 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:59:52 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:59:42 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_bruteforce_slow net_rdp_cookie rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "df7e18c52acae412bb56e0820cfb67ae1e7e9e33", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10afddc9c0cc921f5221549a37c5c941b244e631", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_bruteforce_slow", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:59:27 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:59:18 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:59:03 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:58:54 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:58:39 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:58:29 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:58:14 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:58:05 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }
07/06/2026 18:57:50 UTC	TCP	3389 · RDP	rdp	Sonde RDP rdp probe · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Investiguer Tags mongodb_hello_probe net_rdp_cookie rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload +&�Cookie: mstshash=hello Pourquoi cette classification : Négociation protocole RDP · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) +&�Cookie: mstshash=hello Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000130ed00000123400021f080000000000", "emulator_response_len": 19, "bytes_in": 43, "payload_entropy": 3.9545388822568817, "port_category": "registered", "org": "ColocaTel Inc.", "service": "rdp", "app_proto": "rdp", "asn": 213438, "country": "DE", "dst_port": 3389, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "90e9363eb04b90db11ea7a94dbf74a7981665c9a", "event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 213438, "org": "ColocaTel Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "651808f001ffba20371ae9b433d2894f", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fa2ca8a0ace84fb56a3d6d3f239a1475a2170c9", "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000+&\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)", "evidence_snippet": "+&\ufffdCookie: mstshash=hello", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain" } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "mongodb_hello_probe", "net_rdp_cookie", "rdp_cookie", "rdp_emulated" ] }

193.142.146.219

Géolocalisation

FAI / réseau

Renseignement menaces

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap 24h

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence