Détails IP 203.188.11.114

Synthèse exécutive

Profil de menace

Score de risque 42/100 Moyen

Première observation 08/06/2026 07:29 UTC

Dernière observation 08/06/2026 07:31 UTC

Événements (période) 49

MITRE ATT&CK principal TA0007 49 occurrences

Activité suspecte · risque 32/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Rafale d'authentification SSH · confiance 49%

Confiance 49 % — Score WAF 8

Comparaison ASN / FAI

ASN 7693 · 203.188.0.0/20 · APNIC · 49 événements sur la période pour cette IP.

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

49 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
08/06/2026 07:31:22 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:21 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:20 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:15 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:14 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:11 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556394, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a72b48004fa9a89c27a25a40b2fc7541", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a908687d9b79a82dc50ba4bb63fd3085b171c994", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:10 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:09 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ], "behavior_alert_count": 2, "behavior_priority": 72 }
08/06/2026 07:31:06 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:05 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556394, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a72b48004fa9a89c27a25a40b2fc7541", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a908687d9b79a82dc50ba4bb63fd3085b171c994", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:04 UTC	TCP	5432 · POSTGRES	postgres	Sonde port 5432/TCP port 5432 tcp · via POSTGRES:5432 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Preuve honeypot — Sonde port 5432/TCP Connexion détectée sur le port 5432 (TCP) du capteur simulé. Service POSTGRES Payload Xextra_float_digits2userpostgres_devclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 42 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Xextra_float_digits2userpostgres_devclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 88, "payload_entropy": 4.545865608683338, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0348" ], "kb_rule_ids": [ "pat-0348" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 42 }, "named_classification_skipped": true, "named_candidate": "rdp_probe", "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "59cc6caef67186f24a359cbff90e9e9e", "path_pattern_hash": "d943d6c5be0b5f6ac0e178b059fb362e" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 42 }, "payload_preview": "\u0000\u0000\u0000X\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres_dev\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000X\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres_dev\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000X\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres_dev\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000X\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres_dev\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000X\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres_dev\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d25af433784a01e7174912812e0416661b40b115", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000X\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres_dev\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Xextra_float_digits2userpostgres_devclient_encodingUTF8datestyleISO, MDY", "attack_vector": "port 5432 tcp \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 42 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 42, "risk_label": "Moyen", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0348" ], "tags_summary_labels_fr": [ "pat-0348" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000X\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres_dev\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "port 5432 tcp \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Xextra_float_digits2userpostgres_devclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:03 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:31:00 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:59 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:58 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556394, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a72b48004fa9a89c27a25a40b2fc7541", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a908687d9b79a82dc50ba4bb63fd3085b171c994", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:55 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:54 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:53 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:50 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556394, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a72b48004fa9a89c27a25a40b2fc7541", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a908687d9b79a82dc50ba4bb63fd3085b171c994", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:49 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ], "behavior_alert_count": 2, "behavior_priority": 72 }
08/06/2026 07:30:48 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:48 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:43 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:42 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556394, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a72b48004fa9a89c27a25a40b2fc7541", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a908687d9b79a82dc50ba4bb63fd3085b171c994", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:38 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:37 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:35 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:32 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:30 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:29 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ], "behavior_alert_count": 1, "behavior_priority": 84 }
08/06/2026 07:30:28 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556394, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a72b48004fa9a89c27a25a40b2fc7541", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a908687d9b79a82dc50ba4bb63fd3085b171c994", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:27 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:23 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:21 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:21 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556394, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a72b48004fa9a89c27a25a40b2fc7541", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a908687d9b79a82dc50ba4bb63fd3085b171c994", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tclient_encodingUTF8datestyleISO, MDYextra_float_digits2userpostgres", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:19 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:18 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:14 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:12 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:11 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:09 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:06 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbf441ee75c9a150b3aa1258cf01ec480c8f1f13", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:05 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:02 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "537a28c75189bbe798acead76c49c316c547f8d5", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:30:00 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_bruteforce_burst net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fb9469ec03044cc898f841fc88c62f6e7b931ff1", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ace7ae7c71dc527ca216f0fc9a31208aa89d8d1b", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_bruteforce_burst", "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:29:56 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated postgres_startup postgresql_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 32, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a57bd49dfb8cb61aea06cfebb213d18f7d12405f", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8f0e842fa5939bbd45a5adee7c1671a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "29daf079986e25416d227f7a9ab8ad77af309f41", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "TdatestyleISO, MDYextra_float_digits2userpostgresclient_encodingUTF8", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:29:55 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated postgres_startup postgresql_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 32, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a57bd49dfb8cb61aea06cfebb213d18f7d12405f", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd9a8960b42c9aa82be23242668ef95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "73d4e9c9e6408604103c3dd90f1ba52af1b1ff7c", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000extra_float_digits\u00002\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Textra_float_digits2userpostgresclient_encodingUTF8datestyleISO, MDY", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }
08/06/2026 07:29:53 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "272205ffb91c9631a06988b863bb09a8579d4d67", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 34 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0c2f90aff0214642f91857fa890d68e267a73363", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_postgresql_probe", "postgres_emulated" ] }
08/06/2026 07:29:53 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated postgres_startup postgresql_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header MSSQL TDS prelogin ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000001252000000057573657200706f73746772657300", "emulator_response_len": 23, "bytes_in": 84, "payload_entropy": 4.492852323556393, "port_category": "registered", "org": "KSC Commercial Internet Co. Ltd.", "service": "postgres", "app_proto": "postgres", "asn": 7693, "country": "TH", "dst_port": 5432, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 32, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a57bd49dfb8cb61aea06cfebb213d18f7d12405f", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "MSSQL TDS prelogin", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0356", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "TH", "asn": 7693, "org": "KSC Commercial Internet Co. Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bd518e1c4504550699db4bb08bc5953", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "952b0213158ee1b78ffc9646952ded974ffedac2", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "\u0000\u0000\u0000T\u0000\u0003\u0000\u0000user\u0000postgres\u0000client_encoding\u0000UTF8\u0000datestyle\u0000ISO, MDY\u0000extra_float_digits\u00002\u0000\u0000", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "mssql tds \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "Tuserpostgresclient_encodingUTF8datestyleISO, MDYextra_float_digits2", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_postgresql_probe", "postgres_emulated", "postgres_startup", "postgresql_probe" ] }

203.188.11.114

Pourquoi listée

Comparaison ASN / FAI

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence