21/07/2026 11:38:11 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde PostgreSQL
postgres probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
� �Èy2/4^QY�J 1墽�O�ҥ��o?x3y� =K�� o] D�KAS5S "J�jSĚ�!K ���+�/�,�0̨̩�� � � / 5 S�� #
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Sybase TDS login
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Èy2/4^QY�J 1墽�O�ҥ��o?x3y� =K�� o] D�KAS5S "J�jSĚ�!K ���+�/�,�0̨̩�� � � / 5 S�� #
Requête brute (extrait)
� �Èy2/4^QY�J 1墽�O�ҥ��o?x3y� =K�� o] D�KAS5S "J�jSĚ�!K ���+�/�,�0̨̩�� � � / 5 S�� # ��� � - 3���� �����1��0K�������7���Qh �g�87۷v����E� /�T�ZN���NaY�F��U��ç��`O�~��r
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 1733,
"payload_entropy": 7.7655121092793715,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0607",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Sybase TDS login",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0607",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f9147267f31dd18272b42dd0f32f1f7c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00c8y2\/4^QY\ufffdJ\t1\u0001\u0016\u58bd\ufffdO\ufffd\u04a5\ufffd\ufffdo?x3y\u0007\ufffd =K\ufffd\ufffd\u0000o]\u000b\u0019D\ufffd\u000eKAS5S\u001d\"\u0006J\ufffdjS\u011a\ufffd!K\t\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000\n\u0000\f\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00c8y2\/4^QY\ufffdJ\t1\u0001\u0016\u58bd\ufffdO\ufffd\u04a5\ufffd\ufffdo?x3y\u0007\ufffd =K\ufffd\ufffd\u0000o]\u000b\u0019D\ufffd\u000eKAS5S\u001d\"\u0006J\ufffdjS\u011a\ufffd!K\t\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u00003\u0004\ufffd\u0004\ufffd\ufffd\ufffd\u0000\u0001\u0000\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\u00190K\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd7\ufffd\ufffd\ufffdQh\t\ufffdg\ufffd87\u0003\u06f7v\ufffd\ufffd\ufffd\ufffdE\ufffd\u0001 \/\ufffdT\ufffdZN\ufffd\ufffd\ufffdNaY\ufffdF\ufffd\ufffdU\ufffd\ufffd\u00e7\ufffd\ufffd`O\ufffd~\ufffd\ufffdr",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00c8y2\/4^QY\ufffdJ\t1\u0001\u0016\u58bd\ufffdO\ufffd\u04a5\ufffd\ufffdo?x3y\u0007\ufffd =K\ufffd\ufffd\u0000o]\u000b\u0019D\ufffd\u000eKAS5S\u001d\"\u0006J\ufffdjS\u011a\ufffd!K\t\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000\n\u0000\f\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6aa7c303b2c2ceb6fd62ac54720da3f9f02bc965",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00c8y2\/4^QY\ufffdJ\t1\u0001\u0016\u58bd\ufffdO\ufffd\u04a5\ufffd\ufffdo?x3y\u0007\ufffd =K\ufffd\ufffd\u0000o]\u000b\u0019D\ufffd\u000eKAS5S\u001d\"\u0006J\ufffdjS\u011a\ufffd!K\t\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000\n\u0000\f\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffd\u00c8y2\/4^QY\ufffdJ\t1\u58bd\ufffdO\ufffd\u04a5\ufffd\ufffdo?x3y\ufffd =K\ufffd\ufffdo]D\ufffdKAS5S\"J\ufffdjS\u011a\ufffd!K\t \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5S\ufffd\ufffd#",
"attack_vector": "postgres probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u00c8y2\/4^QY\ufffdJ\t1\u0001\u0016\u58bd\ufffdO\ufffd\u04a5\ufffd\ufffdo?x3y\u0007\ufffd =K\ufffd\ufffd\u0000o]\u000b\u0019D\ufffd\u000eKAS5S\u001d\"\u0006J\ufffdjS\u011a\ufffd!K\t\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000\n\u0000\f\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "postgres probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u00c8y2\/4^QY\ufffdJ\t1\u58bd\ufffdO\ufffd\u04a5\ufffd\ufffdo?x3y\ufffd =K\ufffd\ufffdo]D\ufffdKAS5S\"J\ufffdjS\u011a\ufffd!K\t \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5S\ufffd\ufffd#",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
21/07/2026 11:38:10 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
���_�28� �s�o�9<��]B�I���hǒQ�= 4���v��d:�?�a�Ũ�2g'��B ��"�Z� zz�+�/�,�0̨̩�� � � / 5 ��� # + z
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
���_�28� �s�o�9<��]B�I���hǒQ�= 4���v��d:�?�a�Ũ�2g'��B ��"�Z� zz�+�/�,�0̨̩�� � � / 5 ��� # + z
Requête brute (extrait)
���_�28� �s�o�9<��]B�I���hǒQ�= 4���v��d:�?�a�Ũ�2g'��B ��"�Z� zz�+�/�,�0̨̩�� � � / 5 ��� # + zz� � |� ciG� a<�S��aԺ�[��>LӞ�R�i% ���y��,!e X_RV�Ԇ�*�R�����PTI1_Y� �����5� � �=x?)�a+��OY����C\��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 1797,
"payload_entropy": 7.751402873235331,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1735d1b46081d8aac44eef2551db6c5f",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\u0005_\ufffd2\u00138\ufffd\u001c\ufffds\ufffdo\ufffd9<\ufffd\ufffd]B\ufffdI\ufffd\ufffd\ufffdh\u01d2Q\ufffd= 4\ufffd\ufffd\ufffdv\ufffd\ufffdd:\ufffd?\ufffda\ufffd\u0019\u0168\u0017\ufffd2g'\ufffd\ufffdB\u001f\ufffd\ufffd\"\ufffdZ\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000+\u0000\u0007\u0006z",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\u0005_\ufffd2\u00138\ufffd\u001c\ufffds\ufffdo\ufffd9<\ufffd\ufffd]B\ufffdI\ufffd\ufffd\ufffdh\u01d2Q\ufffd= 4\ufffd\ufffd\ufffdv\ufffd\ufffdd:\ufffd?\ufffda\ufffd\u0019\u0168\u0017\ufffd2g'\ufffd\ufffdB\u001f\ufffd\ufffd\"\ufffdZ\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000+\u0000\u0007\u0006zz\u0003\u0004\u0003\u0003\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 |\ufffd\fciG\ufffd\u0014\na<\ufffdS\ufffd\ufffda\u053a\b\ufffd[\ufffd\ufffd>L\u04de\ufffdR\ufffdi%\u0000\ufffd\ufffd\u0017\ufffdy\ufffd\ufffd,!e\u0000X_RV\ufffd\u0506\u0010\ufffd*\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffdP\u001aTI1_Y\ufffd\u0001\u001f\u0013\ufffd\u0006\ufffd\ufffd\ufffd\ufffd5\u0002\u000e\ufffd\u0000\ufffd\u001f\ufffd=x?)\ufffda\u0011+\u0011\ufffd\ufffdOY\ufffd\ufffd\ufffd\ufffdC\\\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\u0005_\ufffd2\u00138\ufffd\u001c\ufffds\ufffdo\ufffd9<\ufffd\ufffd]B\ufffdI\ufffd\ufffd\ufffdh\u01d2Q\ufffd= 4\ufffd\ufffd\ufffdv\ufffd\ufffdd:\ufffd?\ufffda\ufffd\u0019\u0168\u0017\ufffd2g'\ufffd\ufffdB\u001f\ufffd\ufffd\"\ufffdZ\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000+\u0000\u0007\u0006z",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6dde6ca2494125c7afa8a5aa749b73a5175ea2a3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\u0005_\ufffd2\u00138\ufffd\u001c\ufffds\ufffdo\ufffd9<\ufffd\ufffd]B\ufffdI\ufffd\ufffd\ufffdh\u01d2Q\ufffd= 4\ufffd\ufffd\ufffdv\ufffd\ufffdd:\ufffd?\ufffda\ufffd\u0019\u0168\u0017\ufffd2g'\ufffd\ufffdB\u001f\ufffd\ufffd\"\ufffdZ\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000+\u0000\u0007\u0006z",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffd\ufffd_\ufffd28\ufffd\ufffds\ufffdo\ufffd9<\ufffd\ufffd]B\ufffdI\ufffd\ufffd\ufffdh\u01d2Q\ufffd= 4\ufffd\ufffd\ufffdv\ufffd\ufffdd:\ufffd?\ufffda\ufffd\u0168\ufffd2g'\ufffd\ufffdB\ufffd\ufffd\"\ufffdZ\ufffd zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd#+z",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\u0005_\ufffd2\u00138\ufffd\u001c\ufffds\ufffdo\ufffd9<\ufffd\ufffd]B\ufffdI\ufffd\ufffd\ufffdh\u01d2Q\ufffd= 4\ufffd\ufffd\ufffdv\ufffd\ufffdd:\ufffd?\ufffda\ufffd\u0019\u0168\u0017\ufffd2g'\ufffd\ufffdB\u001f\ufffd\ufffd\"\ufffdZ\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000#\u0000\u0000\u0000+\u0000\u0007\u0006z",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd_\ufffd28\ufffd\ufffds\ufffdo\ufffd9<\ufffd\ufffd]B\ufffdI\ufffd\ufffd\ufffdh\u01d2Q\ufffd= 4\ufffd\ufffd\ufffdv\ufffd\ufffdd:\ufffd?\ufffda\ufffd\u0168\ufffd2g'\ufffd\ufffdB\ufffd\ufffd\"\ufffdZ\ufffd zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd#+z",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
21/07/2026 11:38:09 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Encoding: gzip, def
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 411,
"payload_entropy": 5.425455084191482,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4cc017072399243e3434288c7de3318a",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encoding: gzip, def",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encoding: gzip, def",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f4d956b955d0c72500cdbf3214219fdba60381b",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
21/07/2026 11:38:07 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 593,
"payload_entropy": 5.573734908613864,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b64df3332e49f942b6f3c3dc2b658f3e",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48478bc221e1cc0e43b2834f4bf7ce7af44cbef1",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
21/07/2026 07:21:59 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde Kafka
kafka probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�8���)1�p�e��� ��a�1X#�E"�__# �L�ʆ@�l�`ʩh'Q�c*A �(� g� ���+�/�,�0̨̩�� � � / 5 ��� �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�8���)1�p�e��� ��a�1X#�E"�__# �L�ʆ@�l�`ʩh'Q�c*A �(� g� ���+�/�,�0̨̩�� � � / 5 ��� �
Requête brute (extrait)
�8���)1�p�e��� ��a�1X#�E"�__# �L�ʆ@�l�`ʩh'Q�c*A �(� g� ���+�/�,�0̨̩�� � � / 5 ��� � �� # h2http/1.1 3 + )�� �~�dž����C|�A��h��V-LP��X�-� -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.773488313204637,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "36884ee4170e23f502d8be8abcf6f124",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\u0007\ufffd\u000f\u0012\ufffd)1\ufffdp\ufffde\ufffd\ufffd\ufffd\u001f\ufffd\ufffda\ufffd1X#\ufffdE\"\u0014\ufffd__# \ufffdL\ufffd\u0286@\ufffdl\ufffd\u001a\u000f`\u02a9h'Q\u000f\ufffdc*A\u001f\ufffd\u0007(\ufffd\u001cg\ufffd\u0002\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\u0007\ufffd\u000f\u0012\ufffd)1\ufffdp\ufffde\ufffd\ufffd\ufffd\u001f\ufffd\ufffda\ufffd1X#\ufffdE\"\u0014\ufffd__# \ufffdL\ufffd\u0286@\ufffdl\ufffd\u001a\u000f`\u02a9h'Q\u000f\ufffdc*A\u001f\ufffd\u0007(\ufffd\u001cg\ufffd\u0002\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd~\ufffd\u01c6\ufffd\u0015\ufffd\ufffd\ufffdC|\ufffdA\ufffd\ufffdh\ufffd\ufffdV-LP\ufffd\u0005\ufffdX\ufffd-\ufffd\u0004\u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\u0007\ufffd\u000f\u0012\ufffd)1\ufffdp\ufffde\ufffd\ufffd\ufffd\u001f\ufffd\ufffda\ufffd1X#\ufffdE\"\u0014\ufffd__# \ufffdL\ufffd\u0286@\ufffdl\ufffd\u001a\u000f`\u02a9h'Q\u000f\ufffdc*A\u001f\ufffd\u0007(\ufffd\u001cg\ufffd\u0002\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e254da0a550d7b66b6c40c7f8884d31e14a97e7d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\u0007\ufffd\u000f\u0012\ufffd)1\ufffdp\ufffde\ufffd\ufffd\ufffd\u001f\ufffd\ufffda\ufffd1X#\ufffdE\"\u0014\ufffd__# \ufffdL\ufffd\u0286@\ufffdl\ufffd\u001a\u000f`\u02a9h'Q\u000f\ufffdc*A\u001f\ufffd\u0007(\ufffd\u001cg\ufffd\u0002\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd8\ufffd\ufffd\ufffd)1\ufffdp\ufffde\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd1X#\ufffdE\"\ufffd__# \ufffdL\ufffd\u0286@\ufffdl\ufffd`\u02a9h'Q\ufffdc*A\ufffd(\ufffdg\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\u0007\ufffd\u000f\u0012\ufffd)1\ufffdp\ufffde\ufffd\ufffd\ufffd\u001f\ufffd\ufffda\ufffd1X#\ufffdE\"\u0014\ufffd__# \ufffdL\ufffd\u0286@\ufffdl\ufffd\u001a\u000f`\u02a9h'Q\u000f\ufffdc*A\u001f\ufffd\u0007(\ufffd\u001cg\ufffd\u0002\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd8\ufffd\ufffd\ufffd)1\ufffdp\ufffde\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd1X#\ufffdE\"\ufffd__# \ufffdL\ufffd\u0286@\ufffdl\ufffd`\u02a9h'Q\ufffdc*A\ufffd(\ufffdg\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
21/07/2026 07:21:58 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
��a�#�h�7� . �ev��� h}Ņ�R�#\ -Q�q��#�y�.#��qA�^f�v9��C� *���,�+̩�0�/̨� � �� � � 5 /�� �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��a�#�h�7� . �ev��� h}Ņ�R�#\ -Q�q��#�y�.#��qA�^f�v9��C� *���,�+̩�0�/̨�
� �� � � 5 /��
�
Requête brute (extrait)
��a�#�h�7� . �ev��� h}Ņ�R�#\ -Q�q��#�y�.#��qA�^f�v9��C� *���,�+̩�0�/̨� � �� � � 5 /�� � � �� h2http/1.1 3 + )�� ���2��(��P�4� �X�h
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.884933212311231,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "76cc4cfb74ccded4342eaefbcdcb9f15",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd#\ufffdh\ufffd7\ufffd\t.\u0011\u001d\u001a\ufffdev\u0017\ufffd\ufffd\ufffd\u001ch}\u0145\ufffdR\ufffd#\\ -Q\ufffdq\ufffd\u0012\ufffd#\ufffdy\ufffd.#\ufffd\ufffdqA\u000e\u000e\ufffd^f\ufffdv9\ufffd\b\ufffdC\ufffd\u0017\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd#\ufffdh\ufffd7\ufffd\t.\u0011\u001d\u001a\ufffdev\u0017\ufffd\ufffd\ufffd\u001ch}\u0145\ufffdR\ufffd#\\ -Q\ufffdq\ufffd\u0012\ufffd#\ufffdy\ufffd.#\ufffd\ufffdqA\u000e\u000e\ufffd^f\ufffdv9\ufffd\b\ufffdC\ufffd\u0017\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \u0012\ufffd\ufffd\ufffd2\ufffd\ufffd(\ufffd\ufffdP\ufffd4\ufffd\u000b\u0007\u001c\ufffdX\u000e\ufffd\u0013h",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd#\ufffdh\ufffd7\ufffd\t.\u0011\u001d\u001a\ufffdev\u0017\ufffd\ufffd\ufffd\u001ch}\u0145\ufffdR\ufffd#\\ -Q\ufffdq\ufffd\u0012\ufffd#\ufffdy\ufffd.#\ufffd\ufffdqA\u000e\u000e\ufffd^f\ufffdv9\ufffd\b\ufffdC\ufffd\u0017\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1282efcc8b41dd8b8193915bb8505b28510431e5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd#\ufffdh\ufffd7\ufffd\t.\u0011\u001d\u001a\ufffdev\u0017\ufffd\ufffd\ufffd\u001ch}\u0145\ufffdR\ufffd#\\ -Q\ufffdq\ufffd\u0012\ufffd#\ufffdy\ufffd.#\ufffd\ufffdqA\u000e\u000e\ufffd^f\ufffdv9\ufffd\b\ufffdC\ufffd\u0017\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffda\ufffd#\ufffdh\ufffd7\ufffd\t.\ufffdev\ufffd\ufffd\ufffdh}\u0145\ufffdR\ufffd#\\ -Q\ufffdq\ufffd\ufffd#\ufffdy\ufffd.#\ufffd\ufffdqA\ufffd^f\ufffdv9\ufffd\ufffdC\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd#\ufffdh\ufffd7\ufffd\t.\u0011\u001d\u001a\ufffdev\u0017\ufffd\ufffd\ufffd\u001ch}\u0145\ufffdR\ufffd#\\ -Q\ufffdq\ufffd\u0012\ufffd#\ufffdy\ufffd.#\ufffd\ufffdqA\u000e\u000e\ufffd^f\ufffdv9\ufffd\b\ufffdC\ufffd\u0017\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffda\ufffd#\ufffdh\ufffd7\ufffd\t.\ufffdev\ufffd\ufffd\ufffdh}\u0145\ufffdR\ufffd#\\ -Q\ufffdq\ufffd\ufffd#\ufffdy\ufffd.#\ufffd\ufffdqA\ufffd^f\ufffdv9\ufffd\ufffdC\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
21/07/2026 07:21:57 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 575,
"payload_entropy": 5.5750064570157045,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "42d326e7a128f3e2655af6e0a1600b0c",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c99b1e677b72ad704f0d46da6bb1b6fde358208c",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
21/07/2026 07:21:56 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 601,
"payload_entropy": 5.56022624102517,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e68a7d61b8ab2d1c62205c56428f3271",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945ac3b7c45b82bd8482eb22bbc59205c303c82c",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
21/07/2026 03:06:52 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde PostgreSQL
postgres probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�RH���"��.��q2�]� �Q>� ���@ �ahbl�������z �ǭ� �\�p�����S1& ZZ�+�/�,�0̨̩�� � � / 5 �:: ���
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Kafka ApiVersions key
Sybase TDS login
STUN binding
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�RH���"��.��q2�]�
�Q>�
���@ �ahbl�������z
�ǭ� �\�p�����S1& ZZ�+�/�,�0̨̩�� � � / 5 �::
���
Requête brute (extrait)
�RH���"��.��q2�]� �Q>� ���@ �ahbl�������z �ǭ� �\�p�����S1& ZZ�+�/�,�0̨̩�� � � / 5 �:: ��� # D� h2 - � + JJ 3�튊 �����d�T��,�m����2 ��iԳ�VH
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 1797,
"payload_entropy": 7.776685821880509,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0556",
"pat-0607",
"pat-0771",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Kafka ApiVersions key",
"Sybase TDS login",
"STUN binding",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0556",
"pat-0607",
"pat-0771",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "803ddc47e888a3cc3f2e7c548820220c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003RH\ufffd\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffdq2\ufffd]\ufffd\u0015\r\u0096\u0006\ufffdQ>\ufffd\n\u0011\ufffd\ufffd\ufffd@ \ufffdahbl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\r\ufffd\u01ed\ufffd\u001c\ufffd\\\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdS1&\t\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0011\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003RH\ufffd\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffdq2\ufffd]\ufffd\u0015\r\u0096\u0006\ufffdQ>\ufffd\n\u0011\ufffd\ufffd\ufffd@ \ufffdahbl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\r\ufffd\u01ed\ufffd\u001c\ufffd\\\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdS1&\t\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001D\ufffd\u0000\u0005\u0000\u0003\u0002h2\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000+\u0000\u0007\u0006JJ\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u00003\u0004\ufffd\u0004\ud28a\u0000\u0001\u0000\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffdd\ufffd\u001aT\ufffd\u0011\ufffd,\ufffdm\ufffd\ufffd\ufffd\ufffd2\u001f\ufffd\ufffdi\u0533\ufffdV\u001bH",
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003RH\ufffd\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffdq2\ufffd]\ufffd\u0015\r\u0096\u0006\ufffdQ>\ufffd\n\u0011\ufffd\ufffd\ufffd@ \ufffdahbl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\r\ufffd\u01ed\ufffd\u001c\ufffd\\\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdS1&\t\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0011\ufffd",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c716396d6547c119c708ffb90fce403bf4a08d2e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003RH\ufffd\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffdq2\ufffd]\ufffd\u0015\r\u0096\u0006\ufffdQ>\ufffd\n\u0011\ufffd\ufffd\ufffd@ \ufffdahbl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\r\ufffd\u01ed\ufffd\u001c\ufffd\\\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdS1&\t\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0011\ufffd",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffdRH\ufffd\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffdq2\ufffd]\ufffd\r\u0096\ufffdQ>\ufffd\n\ufffd\ufffd\ufffd@ \ufffdahbl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\r\ufffd\u01ed\ufffd\ufffd\\\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdS1&\t ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\n\n\ufffd\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003RH\ufffd\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffdq2\ufffd]\ufffd\u0015\r\u0096\u0006\ufffdQ>\ufffd\n\u0011\ufffd\ufffd\ufffd@ \ufffdahbl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\r\ufffd\u01ed\ufffd\u001c\ufffd\\\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdS1&\t\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0011\ufffd",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "postgres probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdRH\ufffd\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffdq2\ufffd]\ufffd\r\u0096\ufffdQ>\ufffd\n\ufffd\ufffd\ufffd@ \ufffdahbl\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\r\ufffd\u01ed\ufffd\ufffd\\\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdS1&\t ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\n\n\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
21/07/2026 03:06:50 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�f���l!��ȇ���y_�3R5�u�.;��~�� (�d �F�Y8[�2�h��*��h�������< *���,�+̩�0�/̨� � �� � � 5 /�� ���
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�f���l!��ȇ���y_�3R5�u�.;��~�� (�d �F�Y8[�2�h��*��h�������< *���,�+̩�0�/̨�
� �� � � 5 /��
���
Requête brute (extrait)
�f���l!��ȇ���y_�3R5�u�.;��~�� (�d �F�Y8[�2�h��*��h�������< *���,�+̩�0�/̨� � �� � � 5 /�� ��� � �� h2http/1.1 3 + )�� ?�0V�wW"``Z�oi �bH�l
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.9722994301333405,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bc7d475b9765c2c41633d8ad98538895",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003f\ufffd\ufffd\ufffdl\b!\ufffd\ufffd\u0207\ufffd\ufffd\u0018\ufffdy_\ufffd3R5\ufffdu\ufffd.;\ufffd\ufffd~\ufffd\ufffd (\ufffdd\u001e\ufffdF\ufffdY8[\ufffd\u00122\ufffdh\ufffd\ufffd\u0011*\ufffd\ufffdh\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003f\ufffd\ufffd\ufffdl\b!\ufffd\ufffd\u0207\ufffd\ufffd\u0018\ufffdy_\ufffd3R5\ufffdu\ufffd.;\ufffd\ufffd~\ufffd\ufffd (\ufffdd\u001e\ufffdF\ufffdY8[\ufffd\u00122\ufffdh\ufffd\ufffd\u0011*\ufffd\ufffdh\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 ?\u0005\ufffd0V\ufffdwW\"`\u0004`Z\ufffdoi\u001d\ufffdbH\u0012\ufffdl",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003f\ufffd\ufffd\ufffdl\b!\ufffd\ufffd\u0207\ufffd\ufffd\u0018\ufffdy_\ufffd3R5\ufffdu\ufffd.;\ufffd\ufffd~\ufffd\ufffd (\ufffdd\u001e\ufffdF\ufffdY8[\ufffd\u00122\ufffdh\ufffd\ufffd\u0011*\ufffd\ufffdh\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6e6d7b1714cd127122c2f3172793c290341788bc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003f\ufffd\ufffd\ufffdl\b!\ufffd\ufffd\u0207\ufffd\ufffd\u0018\ufffdy_\ufffd3R5\ufffdu\ufffd.;\ufffd\ufffd~\ufffd\ufffd (\ufffdd\u001e\ufffdF\ufffdY8[\ufffd\u00122\ufffdh\ufffd\ufffd\u0011*\ufffd\ufffdh\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffdf\ufffd\ufffd\ufffdl!\ufffd\ufffd\u0207\ufffd\ufffd\ufffdy_\ufffd3R5\ufffdu\ufffd.;\ufffd\ufffd~\ufffd\ufffd (\ufffdd\ufffdF\ufffdY8[\ufffd2\ufffdh\ufffd\ufffd*\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003f\ufffd\ufffd\ufffdl\b!\ufffd\ufffd\u0207\ufffd\ufffd\u0018\ufffdy_\ufffd3R5\ufffdu\ufffd.;\ufffd\ufffd~\ufffd\ufffd (\ufffdd\u001e\ufffdF\ufffdY8[\ufffd\u00122\ufffdh\ufffd\ufffd\u0011*\ufffd\ufffdh\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdf\ufffd\ufffd\ufffdl!\ufffd\ufffd\u0207\ufffd\ufffd\ufffdy_\ufffd3R5\ufffdu\ufffd.;\ufffd\ufffd~\ufffd\ufffd (\ufffdd\ufffdF\ufffdY8[\ufffd2\ufffdh\ufffd\ufffd*\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
21/07/2026 03:06:48 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 571,
"payload_entropy": 5.577793389100288,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "23b56eaff7498f14ed367d991deca8cf",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f34c977cccac79faf473a45b92e528364440c42",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
21/07/2026 03:06:46 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 Accept: text/html,application/xhtml+xml,applicat
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 615,
"payload_entropy": 5.562454480729503,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8e80d63f1e85a47e2b3d260483c5e9ac",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,applicat",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,applicat",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc6e132ffd623f22cc7a63fe89d892b64bcf8972",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 22:52:17 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
z v=\6�U �V@;b���gž\qW�1�vp� d+ h�������_Ǣ#��.mI�xv ����(�b{� "�+�/̨̩�,�0� � �� � � / 5 �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
z v=\6�U �V@;b���gž\qW�1�vp� d+ h�������_Ǣ#��.mI�xv ����(�b{� "�+�/̨̩�,�0�
� �� � � / 5 �
Requête brute (extrait)
z v=\6�U �V@;b���gž\qW�1�vp� d+ h�������_Ǣ#��.mI�xv ����(�b{� "�+�/̨̩�,�0� � �� � � / 5 � # h2http/1.1 " 3 k i f�<�� �22UK;�,���8ܟ��|T^�{�H A�5�U_m,k/ T~(�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 639,
"payload_entropy": 7.150944364902696,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b2f0db2f77e7dc6a93e9e19e60b2ceed",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003=\\6\ufffdU\u000e\u001c\ufffdV@;b\ufffd\ufffd\ufffdg\u017e\\qW\u000f\ufffd1\ufffd\u0019vp\ufffd\fd+ h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u01e2#\ufffd\ufffd.mI\ufffd\u0016xv\u0003\u000b\ufffd\ufffd\ufffd\ufffd(\ufffdb{\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003=\\6\ufffdU\u000e\u001c\ufffdV@;b\ufffd\ufffd\ufffdg\u017e\\qW\u000f\ufffd1\ufffd\u0019vp\ufffd\fd+ h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u01e2#\ufffd\ufffd.mI\ufffd\u0016xv\u0003\u000b\ufffd\ufffd\ufffd\ufffd(\ufffdb{\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 f\ufffd<\ufffd\ufffd\u001f\ufffd22UK;\ufffd,\ufffd\u0018\ufffd\ufffd8\u071f\ufffd\ufffd\u001b|T^\ufffd{\ufffdH\u0000\u0017\u0000A\u0004\ufffd5\ufffdU_m,k\/\u001f\tT~(\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003=\\6\ufffdU\u000e\u001c\ufffdV@;b\ufffd\ufffd\ufffdg\u017e\\qW\u000f\ufffd1\ufffd\u0019vp\ufffd\fd+ h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u01e2#\ufffd\ufffd.mI\ufffd\u0016xv\u0003\u000b\ufffd\ufffd\ufffd\ufffd(\ufffdb{\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "178388cc47f27b70e1234451005083d5288c924c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003=\\6\ufffdU\u000e\u001c\ufffdV@;b\ufffd\ufffd\ufffdg\u017e\\qW\u000f\ufffd1\ufffd\u0019vp\ufffd\fd+ h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u01e2#\ufffd\ufffd.mI\ufffd\u0016xv\u0003\u000b\ufffd\ufffd\ufffd\ufffd(\ufffdb{\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "zv=\\6\ufffdU\ufffdV@;b\ufffd\ufffd\ufffdg\u017e\\qW\ufffd1\ufffdvp\ufffdd+ h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u01e2#\ufffd\ufffd.mI\ufffdxv\ufffd\ufffd\ufffd\ufffd(\ufffdb{\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003=\\6\ufffdU\u000e\u001c\ufffdV@;b\ufffd\ufffd\ufffdg\u017e\\qW\u000f\ufffd1\ufffd\u0019vp\ufffd\fd+ h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u01e2#\ufffd\ufffd.mI\ufffd\u0016xv\u0003\u000b\ufffd\ufffd\ufffd\ufffd(\ufffdb{\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "zv=\\6\ufffdU\ufffdV@;b\ufffd\ufffd\ufffdg\u017e\\qW\ufffd1\ufffdvp\ufffdd+ h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_\u01e2#\ufffd\ufffd.mI\ufffdxv\ufffd\ufffd\ufffd\ufffd(\ufffdb{\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 22:52:16 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
z v �������Ll�^�4|�A]�ű3��j %N-��������� B�+QI�T�!�f"�F "�+�/̨̩�,�0� � �� � � / 5 �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
z v �������Ll�^�4|�A]�ű3��j %N-��������� B�+QI�T�!�f"�F "�+�/̨̩�,�0�
� �� � � / 5 �
Requête brute (extrait)
z v �������Ll�^�4|�A]�ű3��j %N-��������� B�+QI�T�!�f"�F "�+�/̨̩�,�0� � �� � � / 5 � # h2http/1.1 " 3 k i �A�iE����/O��.1y��R��Z�9s�Q AZf�;E�I���_�c
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 639,
"payload_entropy": 7.16676879422113,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8c3e9c9e330f5c6d4778e80bdb102979",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\u0010\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\u000fl\ufffd\u0004^\u0018\ufffd4|\ufffdA]\u0001\ufffdu\u030b3\ufffd\ufffdj\u0007 %N-\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\u001dB\ufffd+QI\ufffd\u0006T\ufffd!\ufffdf\"\ufffdF\u0005\u0005\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\u0010\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\u000fl\ufffd\u0004^\u0018\ufffd4|\ufffdA]\u0001\ufffdu\u030b3\ufffd\ufffdj\u0007 %N-\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\u001dB\ufffd+QI\ufffd\u0006T\ufffd!\ufffdf\"\ufffdF\u0005\u0005\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 \ufffdA\ufffdiE\ufffd\ufffd\ufffd\u0007\ufffd\/O\ufffd\ufffd.1y\ufffd\ufffdR\ufffd\ufffdZ\ufffd9s\uda07\udf07\ufffdQ\u0000\u0017\u0000A\u0004Zf\ufffd\u0004;E\ufffd\u0015I\ufffd\ufffd\ufffd_\ufffdc",
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\u0010\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\u000fl\ufffd\u0004^\u0018\ufffd4|\ufffdA]\u0001\ufffdu\u030b3\ufffd\ufffdj\u0007 %N-\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\u001dB\ufffd+QI\ufffd\u0006T\ufffd!\ufffdf\"\ufffdF\u0005\u0005\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4637dfe6608cad1373aa64402dc537ffa7239056",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\u0010\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\u000fl\ufffd\u0004^\u0018\ufffd4|\ufffdA]\u0001\ufffdu\u030b3\ufffd\ufffdj\u0007 %N-\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\u001dB\ufffd+QI\ufffd\u0006T\ufffd!\ufffdf\"\ufffdF\u0005\u0005\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "zv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdLl\ufffd^\ufffd4|\ufffdA]\ufffdu\u030b3\ufffd\ufffdj %N-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd+QI\ufffdT\ufffd!\ufffdf\"\ufffdF\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\u0010\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\u000fl\ufffd\u0004^\u0018\ufffd4|\ufffdA]\u0001\ufffdu\u030b3\ufffd\ufffdj\u0007 %N-\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\u001dB\ufffd+QI\ufffd\u0006T\ufffd!\ufffdf\"\ufffdF\u0005\u0005\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "zv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdLl\ufffd^\ufffd4|\ufffdA]\ufffdu\u030b3\ufffd\ufffdj %N-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd+QI\ufffdT\ufffd!\ufffdf\"\ufffdF\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 22:52:15 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,i
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 587,
"payload_entropy": 5.564019238133009,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "efd7d4ec53a992bd59655df2c9d1d7f2",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2c9315a643a7c0368521845c72e6a913b0224c1",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 22:52:13 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:13
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:13
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 439,
"payload_entropy": 5.420861982715894,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ee746149c2bdfcc58063e111591853db",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f40268634c2578fae98445035363a4f45cab7d2",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 18:27:18 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
z vE,��=��F͛�t0��}��*�p�� #��H ̳/#�E���a��;�t-Kc��]]�D1�\�� "�+�/̨̩�,�0� � �� � � / 5 �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
z vE,��=��F͛�t0��}��*�p�� #��H ̳/#�E���a��;�t-Kc��]]�D1�\�� "�+�/̨̩�,�0�
� �� � � / 5 �
Requête brute (extrait)
z vE,��=��F͛�t0��}��*�p�� #��H ̳/#�E���a��;�t-Kc��]]�D1�\�� "�+�/̨̩�,�0� � �� � � / 5 � # h2http/1.1 " 3 k i 腃 !��ɪ������&� �['��Xp A8��]��3m���tj�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 639,
"payload_entropy": 7.149579483057697,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e0c345d1197a72aa86668ff6cd7f5fad",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003E,\ufffd\ufffd=\ufffd\ufffdF\u035b\ufffdt0\ufffd\ufffd}\ufffd\ufffd*\ufffd\u0019p\ufffd\ufffd #\ufffd\ufffdH \u0333\/#\ufffdE\ufffd\ufffd\ufffda\ufffd\ufffd;\ufffdt-\u0089Kc\ufffd\ufffd]]\ufffdD1\ufffd\\\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003E,\ufffd\ufffd=\ufffd\ufffdF\u035b\ufffdt0\ufffd\ufffd}\ufffd\ufffd*\ufffd\u0019p\ufffd\ufffd #\ufffd\ufffdH \u0333\/#\ufffdE\ufffd\ufffd\ufffda\ufffd\ufffd;\ufffdt-\u0089Kc\ufffd\ufffd]]\ufffdD1\ufffd\\\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 \u8143\u001e!\ufffd\ufffd\u026a\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd&\ufffd\f\ufffd\u000e\u0010['\u0016\ufffd\ufffdXp\u0000\u0017\u0000A\u0004\u000e8\ufffd\ufffd]\ufffd\ufffd3m\ufffd\ufffd\ufffdtj\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003E,\ufffd\ufffd=\ufffd\ufffdF\u035b\ufffdt0\ufffd\ufffd}\ufffd\ufffd*\ufffd\u0019p\ufffd\ufffd #\ufffd\ufffdH \u0333\/#\ufffdE\ufffd\ufffd\ufffda\ufffd\ufffd;\ufffdt-\u0089Kc\ufffd\ufffd]]\ufffdD1\ufffd\\\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de6bccbc6857dc5175d34b408265005a2ccb89d5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003E,\ufffd\ufffd=\ufffd\ufffdF\u035b\ufffdt0\ufffd\ufffd}\ufffd\ufffd*\ufffd\u0019p\ufffd\ufffd #\ufffd\ufffdH \u0333\/#\ufffdE\ufffd\ufffd\ufffda\ufffd\ufffd;\ufffdt-\u0089Kc\ufffd\ufffd]]\ufffdD1\ufffd\\\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "zvE,\ufffd\ufffd=\ufffd\ufffdF\u035b\ufffdt0\ufffd\ufffd}\ufffd\ufffd*\ufffdp\ufffd\ufffd #\ufffd\ufffdH \u0333\/#\ufffdE\ufffd\ufffd\ufffda\ufffd\ufffd;\ufffdt-\u0089Kc\ufffd\ufffd]]\ufffdD1\ufffd\\\ufffd\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003E,\ufffd\ufffd=\ufffd\ufffdF\u035b\ufffdt0\ufffd\ufffd}\ufffd\ufffd*\ufffd\u0019p\ufffd\ufffd #\ufffd\ufffdH \u0333\/#\ufffdE\ufffd\ufffd\ufffda\ufffd\ufffd;\ufffdt-\u0089Kc\ufffd\ufffd]]\ufffdD1\ufffd\\\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "zvE,\ufffd\ufffd=\ufffd\ufffdF\u035b\ufffdt0\ufffd\ufffd}\ufffd\ufffd*\ufffdp\ufffd\ufffd #\ufffd\ufffdH \u0333\/#\ufffdE\ufffd\ufffd\ufffda\ufffd\ufffd;\ufffdt-\u0089Kc\ufffd\ufffd]]\ufffdD1\ufffd\\\ufffd\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 18:27:16 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde Kafka
kafka probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
� ��p�Z�K�n�S� � ~LM��!���aN���U C 8ޤ�+7�c�DG;)<p�0�1���) � ���+�/�,�0̨̩�� � � / 5 3�� h2
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��p�Z�K�n�S�
� ~LM��!���aN���U C 8ޤ�+7�c�DG;)<p�0�1���)
� ���+�/�,�0̨̩�� � � / 5 3�� h2
Requête brute (extrait)
� ��p�Z�K�n�S� � ~LM��!���aN���U C 8ޤ�+7�c�DG;)<p�0�1���) � ���+�/�,�0̨̩�� � � / 5 3�� h2http/1.1 # � D� h2 ZZ� - � � + � �y��{J� �}��:ц
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 1701,
"payload_entropy": 7.7469554417570485,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e010f33b5da55ece9d4583741ffd0613",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdp\ufffdZ\ufffdK\ufffdn\ufffdS\ufffd\u0005\n\ufffd\u001e~LM\ufffd\ufffd!\ufffd\u0010\ufffd\ufffdaN\ufffd\ufffd\u0015\ufffdU C\u001e8\u07a4\ufffd+7\ufffdc\ufffdDG;)<p\ufffd0\u0003\ufffd1\ufffd\u0002\ufffd\ufffd)\n\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdp\ufffdZ\ufffdK\ufffdn\ufffdS\ufffd\u0005\n\ufffd\u001e~LM\ufffd\ufffd!\ufffd\u0010\ufffd\ufffdaN\ufffd\ufffd\u0015\ufffdU C\u001e8\u07a4\ufffd+7\ufffdc\ufffdDG;)<p\ufffd0\u0003\ufffd1\ufffd\u0002\ufffd\ufffd)\n\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002D\ufffd\u0000\u0005\u0000\u0003\u0002h2\u0000\u0017\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\n\u0000\f\u0000\nZZ\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001+\u0000 \ufffd\f\ufffdy\ufffd\ufffd{J\ufffd \ufffd}\ufffd\u0014\u0007\ufffd:\u0014\u0446",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdp\ufffdZ\ufffdK\ufffdn\ufffdS\ufffd\u0005\n\ufffd\u001e~LM\ufffd\ufffd!\ufffd\u0010\ufffd\ufffdaN\ufffd\ufffd\u0015\ufffdU C\u001e8\u07a4\ufffd+7\ufffdc\ufffdDG;)<p\ufffd0\u0003\ufffd1\ufffd\u0002\ufffd\ufffd)\n\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f60efb4053ea65e49dafbc2ffcf124acbc8c4f59",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdp\ufffdZ\ufffdK\ufffdn\ufffdS\ufffd\u0005\n\ufffd\u001e~LM\ufffd\ufffd!\ufffd\u0010\ufffd\ufffdaN\ufffd\ufffd\u0015\ufffdU C\u001e8\u07a4\ufffd+7\ufffdc\ufffdDG;)<p\ufffd0\u0003\ufffd1\ufffd\u0002\ufffd\ufffd)\n\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffd\ufffdp\ufffdZ\ufffdK\ufffdn\ufffdS\ufffd\n\ufffd~LM\ufffd\ufffd!\ufffd\ufffd\ufffdaN\ufffd\ufffd\ufffdU C8\u07a4\ufffd+7\ufffdc\ufffdDG;)<p\ufffd0\ufffd1\ufffd\ufffd\ufffd)\n\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53\ufffd\ufffdh2",
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdp\ufffdZ\ufffdK\ufffdn\ufffdS\ufffd\u0005\n\ufffd\u001e~LM\ufffd\ufffd!\ufffd\u0010\ufffd\ufffdaN\ufffd\ufffd\u0015\ufffdU C\u001e8\u07a4\ufffd+7\ufffdc\ufffdDG;)<p\ufffd0\u0003\ufffd1\ufffd\u0002\ufffd\ufffd)\n\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdp\ufffdZ\ufffdK\ufffdn\ufffdS\ufffd\n\ufffd~LM\ufffd\ufffd!\ufffd\ufffd\ufffdaN\ufffd\ufffd\ufffdU C8\u07a4\ufffd+7\ufffdc\ufffdDG;)<p\ufffd0\ufffd1\ufffd\ufffd\ufffd)\n\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53\ufffd\ufffdh2",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 18:27:15 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,i
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 586,
"payload_entropy": 5.551665210893404,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f50332e60cfa35f0ed277a42759ec5d8",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37af0c463dd4e77a14ce2ffa0335c1b287925e08",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 18:27:14 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:13
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:13
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 439,
"payload_entropy": 5.420861982715894,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ea0412a17a8e7987a0ca186c9f50e4d8",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07ff103a321da42638a293c1cb33c703651773a2",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:13",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 14:00:59 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
���k5Jջ����l�g��� ߐ�]qA���] 7�}/��[K�u��!�|���/oٕ-%b�5*� * �,�+̩�0�/̨� � �� � � 5 /�� ���
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
���k5Jջ����l�g���
ߐ�]qA���] 7�}/��[K�u��!�|���/oٕ-%b�5*� *
�,�+̩�0�/̨�
� �� � � 5 /��
���
Requête brute (extrait)
���k5Jջ����l�g��� ߐ�]qA���] 7�}/��[K�u��!�|���/oٕ-%b�5*� * �,�+̩�0�/̨� � �� � � 5 /�� ��� � ** h2http/1.1 3 + )** ���m��� Ծ�'�:�*�d��A
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.9148734730184276,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "960d6759af23540e6fbbc0f49ca05321",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk5J\u057b\u0006\ufffd\u0015\ufffd\ufffd\ufffdl\ufffdg\ufffd\ufffd\b\ufffd\r\u07d0\ufffd]qA\ufffd\ufffd\ufffd] \u000b7\ufffd\u0002}\/\ufffd\ufffd[K\ufffdu\ufffd\ufffd!\ufffd|\ufffd\ufffd\ufffd\/o\u0655-\b%b\ufffd5*\ufffd\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk5J\u057b\u0006\ufffd\u0015\ufffd\ufffd\ufffdl\ufffdg\ufffd\ufffd\b\ufffd\r\u07d0\ufffd]qA\ufffd\ufffd\ufffd] \u000b7\ufffd\u0002}\/\ufffd\ufffd[K\ufffdu\ufffd\ufffd!\ufffd|\ufffd\ufffd\ufffd\/o\u0655-\b%b\ufffd5*\ufffd\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n**\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)**\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\u001c\u001d\u001c\u053e\ufffd'\ufffd:\ufffd*\ufffdd\ufffd\ufffdA",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk5J\u057b\u0006\ufffd\u0015\ufffd\ufffd\ufffdl\ufffdg\ufffd\ufffd\b\ufffd\r\u07d0\ufffd]qA\ufffd\ufffd\ufffd] \u000b7\ufffd\u0002}\/\ufffd\ufffd[K\ufffdu\ufffd\ufffd!\ufffd|\ufffd\ufffd\ufffd\/o\u0655-\b%b\ufffd5*\ufffd\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54b63ff793dfc239bef4ecd932187042fd5a3cc7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk5J\u057b\u0006\ufffd\u0015\ufffd\ufffd\ufffdl\ufffdg\ufffd\ufffd\b\ufffd\r\u07d0\ufffd]qA\ufffd\ufffd\ufffd] \u000b7\ufffd\u0002}\/\ufffd\ufffd[K\ufffdu\ufffd\ufffd!\ufffd|\ufffd\ufffd\ufffd\/o\u0655-\b%b\ufffd5*\ufffd\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffd\ufffdk5J\u057b\ufffd\ufffd\ufffd\ufffdl\ufffdg\ufffd\ufffd\ufffd\r\u07d0\ufffd]qA\ufffd\ufffd\ufffd] 7\ufffd}\/\ufffd\ufffd[K\ufffdu\ufffd\ufffd!\ufffd|\ufffd\ufffd\ufffd\/o\u0655-%b\ufffd5*\ufffd*\n\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk5J\u057b\u0006\ufffd\u0015\ufffd\ufffd\ufffdl\ufffdg\ufffd\ufffd\b\ufffd\r\u07d0\ufffd]qA\ufffd\ufffd\ufffd] \u000b7\ufffd\u0002}\/\ufffd\ufffd[K\ufffdu\ufffd\ufffd!\ufffd|\ufffd\ufffd\ufffd\/o\u0655-\b%b\ufffd5*\ufffd\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdk5J\u057b\ufffd\ufffd\ufffd\ufffdl\ufffdg\ufffd\ufffd\ufffd\r\u07d0\ufffd]qA\ufffd\ufffd\ufffd] 7\ufffd}\/\ufffd\ufffd[K\ufffdu\ufffd\ufffd!\ufffd|\ufffd\ufffd\ufffd\/o\u0655-%b\ufffd5*\ufffd*\n\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 14:00:58 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde Kafka
kafka probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�r{\���~��X6MOC{��%�=r{��N%7;Ʌ �LuB!�qI����O�w�[B_<�1��=|��� **�+�/�,�0̨̩�� � � / 5 �:: �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�r{\���~��X6MOC{��%�=r{��N%7;Ʌ �LuB!�qI����O�w�[B_<�1��=|��� **�+�/�,�0̨̩�� � � / 5 �:: �
Requête brute (extrait)
�r{\���~��X6MOC{��%�=r{��N%7;Ʌ �LuB!�qI����O�w�[B_<�1��=|��� **�+�/�,�0̨̩�� � � / 5 �:: � �� # h2http/1.1 3 + )�� G�c��P�<xN�.��Vu �*��*9߶�Y���n -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.819037394484395,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a8dc232df55c2c7ecba76c4755bc1ef0",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003r{\\\ufffd\ufffd\ufffd~\ufffd\ufffdX6MOC{\ufffd\ufffd%\ufffd=r{\ufffd\u0016\ufffdN%7;\u0245 \ufffdLuB!\ufffdq\u0011I\ufffd\ufffd\ufffd\ufffdO\ufffdw\ufffd[B_<\ufffd1\ufffd\ufffd=|\ufffd\ufffd\ufffd\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003r{\\\ufffd\ufffd\ufffd~\ufffd\ufffdX6MOC{\ufffd\ufffd%\ufffd=r{\ufffd\u0016\ufffdN%7;\u0245 \ufffdLuB!\ufffdq\u0011I\ufffd\ufffd\ufffd\ufffdO\ufffdw\ufffd[B_<\ufffd1\ufffd\ufffd=|\ufffd\ufffd\ufffd\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 G\ufffdc\ufffd\ufffdP\ufffd<xN\ufffd.\u0006\ufffd\ufffdVu\u001e\ufffd*\ufffd\ufffd*9\u07f6\ufffdY\ufffd\ufffd\ufffdn\u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003r{\\\ufffd\ufffd\ufffd~\ufffd\ufffdX6MOC{\ufffd\ufffd%\ufffd=r{\ufffd\u0016\ufffdN%7;\u0245 \ufffdLuB!\ufffdq\u0011I\ufffd\ufffd\ufffd\ufffdO\ufffdw\ufffd[B_<\ufffd1\ufffd\ufffd=|\ufffd\ufffd\ufffd\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a07e37202741adf3b934c3314ed587eac62187a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003r{\\\ufffd\ufffd\ufffd~\ufffd\ufffdX6MOC{\ufffd\ufffd%\ufffd=r{\ufffd\u0016\ufffdN%7;\u0245 \ufffdLuB!\ufffdq\u0011I\ufffd\ufffd\ufffd\ufffdO\ufffdw\ufffd[B_<\ufffd1\ufffd\ufffd=|\ufffd\ufffd\ufffd\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffdr{\\\ufffd\ufffd\ufffd~\ufffd\ufffdX6MOC{\ufffd\ufffd%\ufffd=r{\ufffd\ufffdN%7;\u0245 \ufffdLuB!\ufffdqI\ufffd\ufffd\ufffd\ufffdO\ufffdw\ufffd[B_<\ufffd1\ufffd\ufffd=|\ufffd\ufffd\ufffd **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\ufffd",
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003r{\\\ufffd\ufffd\ufffd~\ufffd\ufffdX6MOC{\ufffd\ufffd%\ufffd=r{\ufffd\u0016\ufffdN%7;\u0245 \ufffdLuB!\ufffdq\u0011I\ufffd\ufffd\ufffd\ufffdO\ufffdw\ufffd[B_<\ufffd1\ufffd\ufffd=|\ufffd\ufffd\ufffd\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdr{\\\ufffd\ufffd\ufffd~\ufffd\ufffdX6MOC{\ufffd\ufffd%\ufffd=r{\ufffd\ufffdN%7;\u0245 \ufffdLuB!\ufffdqI\ufffd\ufffd\ufffd\ufffdO\ufffdw\ufffd[B_<\ufffd1\ufffd\ufffd=|\ufffd\ufffd\ufffd **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 14:00:57 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/201
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/201
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Encod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 425,
"payload_entropy": 5.3898085221671765,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b3b7fc44ab495a4ee0594dedf3808aa3",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/201",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encod",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/201",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encod",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/201",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e138ae122ee31cc8bf13c88444a230d9ea5144ac",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/201",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/201",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/201",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/201",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 14:00:55 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 593,
"payload_entropy": 5.573734908613864,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b64df3332e49f942b6f3c3dc2b658f3e",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48478bc221e1cc0e43b2834f4bf7ce7af44cbef1",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 09:39:47 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�Ile����]�X��!E&w�� |�p��۩�r! <����&�P �չ���~��(BM��r�F��� *���,�+̩�0�/̨� � �� � � 5 /�� ���
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�Ile����]�X��!E&w�� |�p��۩�r! <����&�P �չ���~��(BM��r�F��� *���,�+̩�0�/̨�
� �� � � 5 /��
���
Requête brute (extrait)
�Ile����]�X��!E&w�� |�p��۩�r! <����&�P �չ���~��(BM��r�F��� *���,�+̩�0�/̨� � �� � � 5 /�� ��� � zz h2http/1.1 3 + )zz e�ʐg���}~3�H�K�S�ý
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.956987414581953,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "be804b6f9c7dceb6a5d0cef7cefdc7ed",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ile\ufffd\ufffd\ufffd\ufffd\u0006]\ufffdX\ufffd\ufffd!E&w\ufffd\ufffd\f|\ufffdp\ufffd\ufffd\u0004\u06e9\ufffdr\u0006! <\ufffd\ufffd\ufffd\ufffd&\ufffdP\u001e\ufffd\u0579\ufffd\ufffd\ufffd~\ufffd\ufffd(\u0013BM\ufffd\ufffdr\u0011\ufffdF\u0006\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ile\ufffd\ufffd\ufffd\ufffd\u0006]\ufffdX\ufffd\ufffd!E&w\ufffd\ufffd\f|\ufffdp\ufffd\ufffd\u0004\u06e9\ufffdr\u0006! <\ufffd\ufffd\ufffd\ufffd&\ufffdP\u001e\ufffd\u0579\ufffd\ufffd\ufffd~\ufffd\ufffd(\u0013BM\ufffd\ufffdr\u0011\ufffdF\u0006\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\nzz\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)zz\u0000\u0001\u0000\u0000\u001d\u0000 e\ufffd\u0290g\u0004\ufffd\ufffd\ufffd}~3\u0002\ufffdH\ufffdK\ufffdS\ufffd\u000e\u00fd",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ile\ufffd\ufffd\ufffd\ufffd\u0006]\ufffdX\ufffd\ufffd!E&w\ufffd\ufffd\f|\ufffdp\ufffd\ufffd\u0004\u06e9\ufffdr\u0006! <\ufffd\ufffd\ufffd\ufffd&\ufffdP\u001e\ufffd\u0579\ufffd\ufffd\ufffd~\ufffd\ufffd(\u0013BM\ufffd\ufffdr\u0011\ufffdF\u0006\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a4d2b92fcfba81fa1a794c9cef942d0a227b012",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ile\ufffd\ufffd\ufffd\ufffd\u0006]\ufffdX\ufffd\ufffd!E&w\ufffd\ufffd\f|\ufffdp\ufffd\ufffd\u0004\u06e9\ufffdr\u0006! <\ufffd\ufffd\ufffd\ufffd&\ufffdP\u001e\ufffd\u0579\ufffd\ufffd\ufffd~\ufffd\ufffd(\u0013BM\ufffd\ufffdr\u0011\ufffdF\u0006\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffdIle\ufffd\ufffd\ufffd\ufffd]\ufffdX\ufffd\ufffd!E&w\ufffd\ufffd|\ufffdp\ufffd\ufffd\u06e9\ufffdr! <\ufffd\ufffd\ufffd\ufffd&\ufffdP\ufffd\u0579\ufffd\ufffd\ufffd~\ufffd\ufffd(BM\ufffd\ufffdr\ufffdF\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ile\ufffd\ufffd\ufffd\ufffd\u0006]\ufffdX\ufffd\ufffd!E&w\ufffd\ufffd\f|\ufffdp\ufffd\ufffd\u0004\u06e9\ufffdr\u0006! <\ufffd\ufffd\ufffd\ufffd&\ufffdP\u001e\ufffd\u0579\ufffd\ufffd\ufffd~\ufffd\ufffd(\u0013BM\ufffd\ufffdr\u0011\ufffdF\u0006\ufffd\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdIle\ufffd\ufffd\ufffd\ufffd]\ufffdX\ufffd\ufffd!E&w\ufffd\ufffd|\ufffdp\ufffd\ufffd\u06e9\ufffdr! <\ufffd\ufffd\ufffd\ufffd&\ufffdP\ufffd\u0579\ufffd\ufffd\ufffd~\ufffd\ufffd(BM\ufffd\ufffdr\ufffdF\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 09:39:46 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�O�)�s�s�?�1y^G�(~H�h�a��bS� �Æ����C�z�L2 � .���?C�^��n�� *���,�+̩�0�/̨� � �� � � 5 /�� ���
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�O�)�s�s�?�1y^G�(~H�h�a��bS� �Æ����C�z�L2 � .���?C�^��n�� *���,�+̩�0�/̨�
� �� � � 5 /��
���
Requête brute (extrait)
�O�)�s�s�?�1y^G�(~H�h�a��bS� �Æ����C�z�L2 � .���?C�^��n�� *���,�+̩�0�/̨� � �� � � 5 /�� ��� � jj h2http/1.1 3 + )jj ��T���7�N$;�]i�\Z|�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.966223727189883,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1253ae943944416ade6517ec2f23205e",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffd)\ufffds\ufffd\u0011s\ufffd?\ufffd1y^G\ufffd(~H\ufffdh\u0011\ufffda\ufffd\ufffdbS\ufffd \ufffd\u00c6\ufffd\ufffd\ufffd\ufffdC\u0004\ufffdz\ufffdL2\u001c\ufffd\f.\ufffd\ufffd\ufffd?C\ufffd^\ufffd\ufffdn\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffd)\ufffds\ufffd\u0011s\ufffd?\ufffd1y^G\ufffd(~H\ufffdh\u0011\ufffda\ufffd\ufffdbS\ufffd \ufffd\u00c6\ufffd\ufffd\ufffd\ufffdC\u0004\ufffdz\ufffdL2\u001c\ufffd\f.\ufffd\ufffd\ufffd?C\ufffd^\ufffd\ufffdn\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\njj\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)jj\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffdT\u0019\ufffd\u0015\ufffd\ufffd7\ufffdN$;\ufffd]\u000fi\ufffd\\Z|\ufffd\u0002",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffd)\ufffds\ufffd\u0011s\ufffd?\ufffd1y^G\ufffd(~H\ufffdh\u0011\ufffda\ufffd\ufffdbS\ufffd \ufffd\u00c6\ufffd\ufffd\ufffd\ufffdC\u0004\ufffdz\ufffdL2\u001c\ufffd\f.\ufffd\ufffd\ufffd?C\ufffd^\ufffd\ufffdn\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6711960451af7a6b9f757c4edb94c3bba16753c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffd)\ufffds\ufffd\u0011s\ufffd?\ufffd1y^G\ufffd(~H\ufffdh\u0011\ufffda\ufffd\ufffdbS\ufffd \ufffd\u00c6\ufffd\ufffd\ufffd\ufffdC\u0004\ufffdz\ufffdL2\u001c\ufffd\f.\ufffd\ufffd\ufffd?C\ufffd^\ufffd\ufffdn\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffdO\ufffd)\ufffds\ufffds\ufffd?\ufffd1y^G\ufffd(~H\ufffdh\ufffda\ufffd\ufffdbS\ufffd \ufffd\u00c6\ufffd\ufffd\ufffd\ufffdC\ufffdz\ufffdL2\ufffd.\ufffd\ufffd\ufffd?C\ufffd^\ufffd\ufffdn\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffd)\ufffds\ufffd\u0011s\ufffd?\ufffd1y^G\ufffd(~H\ufffdh\u0011\ufffda\ufffd\ufffdbS\ufffd \ufffd\u00c6\ufffd\ufffd\ufffd\ufffdC\u0004\ufffdz\ufffdL2\u001c\ufffd\f.\ufffd\ufffd\ufffd?C\ufffd^\ufffd\ufffdn\ufffd\ufffd\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdO\ufffd)\ufffds\ufffds\ufffd?\ufffd1y^G\ufffd(~H\ufffdh\ufffda\ufffd\ufffdbS\ufffd \ufffd\u00c6\ufffd\ufffd\ufffd\ufffdC\ufffdz\ufffdL2\ufffd.\ufffd\ufffd\ufffd?C\ufffd^\ufffd\ufffdn\ufffd\ufffd*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 09:39:45 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 575,
"payload_entropy": 5.5750064570157045,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "42d326e7a128f3e2655af6e0a1600b0c",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c99b1e677b72ad704f0d46da6bb1b6fde358208c",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 09:39:44 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 470,
"payload_entropy": 5.449921012042444,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "04c22a6f2f977457a3de09221d7f7819",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd22d414b4eb95f537dd22ab78af841d1e81a964",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 05:09:54 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
��N����F��62a`Z� {vkxWB /I�> Z ��\�+^2�]��� �* �+�r���< *���,�+̩�0�/̨� � �� � � 5 /�� �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��N����F��62a`Z� {vkxWB
/I�>
Z ��\�+^2�]���
�* �+�r���< *���,�+̩�0�/̨�
� �� � � 5 /��
�
Requête brute (extrait)
��N����F��62a`Z� {vkxWB /I�> Z ��\�+^2�]��� �* �+�r���< *���,�+̩�0�/̨� � �� � � 5 /�� � � �� h2http/1.1 3 + )�� \f܋S���J��nS�E��y���p
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.90479573431194,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d4f20bfbe2bd858d0ff93fe2c260f25",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN\ufffd\ufffd\u001a\ufffd\ufffdF\ufffd\ufffd62a`\u0011Z\ufffd\u000b\u0016{vkxWB\n\/I\ufffd>\rZ \ufffd\ufffd\\\u0015\ufffd+^\u00062\ufffd]\ufffd\ufffd\ufffd\n\ufffd*\u000f\u0012\u0015\u0000\ufffd\u000e+\ufffd\u0012r\ufffd\ufffd\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN\ufffd\ufffd\u001a\ufffd\ufffdF\ufffd\ufffd62a`\u0011Z\ufffd\u000b\u0016{vkxWB\n\/I\ufffd>\rZ \ufffd\ufffd\\\u0015\ufffd+^\u00062\ufffd]\ufffd\ufffd\ufffd\n\ufffd*\u000f\u0012\u0015\u0000\ufffd\u000e+\ufffd\u0012r\ufffd\ufffd\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \\f\u0001\u070bS\ufffd\ufffd\ufffdJ\ufffd\ufffdnS\ufffdE\ufffd\ufffdy\ufffd\ufffd\ufffdp",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN\ufffd\ufffd\u001a\ufffd\ufffdF\ufffd\ufffd62a`\u0011Z\ufffd\u000b\u0016{vkxWB\n\/I\ufffd>\rZ \ufffd\ufffd\\\u0015\ufffd+^\u00062\ufffd]\ufffd\ufffd\ufffd\n\ufffd*\u000f\u0012\u0015\u0000\ufffd\u000e+\ufffd\u0012r\ufffd\ufffd\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "67910c9094244be597b7336d8832afb55789cac7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN\ufffd\ufffd\u001a\ufffd\ufffdF\ufffd\ufffd62a`\u0011Z\ufffd\u000b\u0016{vkxWB\n\/I\ufffd>\rZ \ufffd\ufffd\\\u0015\ufffd+^\u00062\ufffd]\ufffd\ufffd\ufffd\n\ufffd*\u000f\u0012\u0015\u0000\ufffd\u000e+\ufffd\u0012r\ufffd\ufffd\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd62a`Z\ufffd{vkxWB\n\/I\ufffd>\rZ \ufffd\ufffd\\\ufffd+^2\ufffd]\ufffd\ufffd\ufffd\n\ufffd*\ufffd+\ufffdr\ufffd\ufffd\ufffd<*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdN\ufffd\ufffd\u001a\ufffd\ufffdF\ufffd\ufffd62a`\u0011Z\ufffd\u000b\u0016{vkxWB\n\/I\ufffd>\rZ \ufffd\ufffd\\\u0015\ufffd+^\u00062\ufffd]\ufffd\ufffd\ufffd\n\ufffd*\u000f\u0012\u0015\u0000\ufffd\u000e+\ufffd\u0012r\ufffd\ufffd\ufffd<\u0000*\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\n\n\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd62a`Z\ufffd{vkxWB\n\/I\ufffd>\rZ \ufffd\ufffd\\\ufffd+^2\ufffd]\ufffd\ufffd\ufffd\n\ufffd*\ufffd+\ufffdr\ufffd\ufffd\ufffd<*\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 05:09:53 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde Kafka
kafka probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�ь���elB�gO8/��u YB����]Fd�� ��������g������+ɍ�9�d�%��;M zz�+�/�,�0̨̩�� � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�ь���elB�gO8/��u YB����]Fd�� ��������g������+ɍ�9�d�%��;M zz�+�/�,�0̨̩�� � � / 5 �
�
Requête brute (extrait)
�ь���elB�gO8/��u YB����]Fd�� ��������g������+ɍ�9�d�%��;M zz�+�/�,�0̨̩�� � � / 5 � � jj # h2http/1.1 3 + )jj 'U``��N]j��p>ge�� s{l���]�H��� -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.797367629459502,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6e3a3de90ea6dd810eeb5849771e3f94",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u044c\u0006\ufffd\ufffd\u0007\ufffdelB\ufffdg\u0006O8\u0012\/\ufffd\ufffdu YB\ufffd\ufffd\ufffd\ufffd]Fd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\u0019\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\u024d\ufffd9\ufffdd\ufffd%\ufffd\ufffd;M\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u044c\u0006\ufffd\ufffd\u0007\ufffdelB\ufffdg\u0006O8\u0012\/\ufffd\ufffdu YB\ufffd\ufffd\ufffd\ufffd]Fd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\u0019\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\u024d\ufffd9\ufffdd\ufffd%\ufffd\ufffd;M\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\bjj\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)jj\u0000\u0001\u0000\u0000\u001d\u0000 'U``\ufffd\ufffdN]j\ufffd\ufffdp>ge\ufffd\ufffd\u001es{l\ufffd\ufffd\ufffd]\ufffdH\ufffd\ufffd\u0005\ufffd\u0016\u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u044c\u0006\ufffd\ufffd\u0007\ufffdelB\ufffdg\u0006O8\u0012\/\ufffd\ufffdu YB\ufffd\ufffd\ufffd\ufffd]Fd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\u0019\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\u024d\ufffd9\ufffdd\ufffd%\ufffd\ufffd;M\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb31294be010afbeb447903536295d64a476da5f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u044c\u0006\ufffd\ufffd\u0007\ufffdelB\ufffdg\u0006O8\u0012\/\ufffd\ufffdu YB\ufffd\ufffd\ufffd\ufffd]Fd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\u0019\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\u024d\ufffd9\ufffdd\ufffd%\ufffd\ufffd;M\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd\u044c\ufffd\ufffd\ufffdelB\ufffdgO8\/\ufffd\ufffdu YB\ufffd\ufffd\ufffd\ufffd]Fd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\u024d\ufffd9\ufffdd\ufffd%\ufffd\ufffd;M zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\n\n\ufffd",
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u044c\u0006\ufffd\ufffd\u0007\ufffdelB\ufffdg\u0006O8\u0012\/\ufffd\ufffdu YB\ufffd\ufffd\ufffd\ufffd]Fd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\u0019\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\u024d\ufffd9\ufffdd\ufffd%\ufffd\ufffd;M\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u044c\ufffd\ufffd\ufffdelB\ufffdgO8\/\ufffd\ufffdu YB\ufffd\ufffd\ufffd\ufffd]Fd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\u024d\ufffd9\ufffdd\ufffd%\ufffd\ufffd;M zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\n\n\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
20/07/2026 05:09:51 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1 Accept: text/html,application/xhtml+xml,application/xml;
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 470,
"payload_entropy": 5.477301754240557,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a997e34ec2ef517fca1e27cd846a402",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Mobile\/15E148 Safari\/604.1\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Mobile\/15E148 Safari\/604.1\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "95ab2aea051cc2d3629f26ebeb01405bf45bec3b",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKi",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
20/07/2026 05:09:50 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 589,
"payload_entropy": 5.575912014928999,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8bf151f8c0852b44814fac24c6637738",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c46c8a54df88926ac858c4f1da96ff8863da2595",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 23:41:03 UTC
TCP
8065 · Mattermost (chat d'équipe)
Sonde Kafka
kafka probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
�? �КU�:�uU� =T�Jf�Љ�b�V�I2� c����$mP���c�F�}�x���D��]��� zz�+�/�,�0̨̩�� � � / 5 �zz �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�?
�КU�:�uU� =T�Jf�Љ�b�V�I2� c����$mP���c�F�}�x���D��]��� zz�+�/�,�0̨̩�� � � / 5 �zz �
Requête brute (extrait)
�? �КU�:�uU� =T�Jf�Љ�b�V�I2� c����$mP���c�F�}�x���D��]��� zz�+�/�,�0̨̩�� � � / 5 �zz � zz # h2http/1.1 3 + )zz �� ��p�)��|$}y��H�|'J� #�ڐ� \ -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 517,
"payload_entropy": 3.781843603164064,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d0e12b636a912b339f06c95d3a7c02d8",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\n\ufffd\u041aU\ufffd:\ufffduU\ufffd\u001e=T\ufffd\bJf\ufffd\u0409\ufffdb\ufffdV\ufffdI\u00102\ufffd\u0012 \u0000c\ufffd\ufffd\ufffd\ufffd$mP\ufffd\ufffd\ufffd\u0011c\ufffdF\ufffd}\ufffdx\ufffd\u0019\ufffd\ufffdD\ufffd\ufffd]\ufffd\ufffd\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\n\ufffd\u041aU\ufffd:\ufffduU\ufffd\u001e=T\ufffd\bJf\ufffd\u0409\ufffdb\ufffdV\ufffdI\u00102\ufffd\u0012 \u0000c\ufffd\ufffd\ufffd\ufffd$mP\ufffd\ufffd\ufffd\u0011c\ufffdF\ufffd}\ufffdx\ufffd\u0019\ufffd\ufffdD\ufffd\ufffd]\ufffd\ufffd\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\bzz\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)zz\u0000\u0001\u0000\u0000\u001d\u0000 \u05f5\ufffd\ufffd\u001f\ufffd\ufffdp\ufffd)\ufffd\ufffd|$}y\ufffd\ufffdH\ufffd|'J\ufffd\u0000#\ufffd\u0690\ufffd\r\\\u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\n\ufffd\u041aU\ufffd:\ufffduU\ufffd\u001e=T\ufffd\bJf\ufffd\u0409\ufffdb\ufffdV\ufffdI\u00102\ufffd\u0012 \u0000c\ufffd\ufffd\ufffd\ufffd$mP\ufffd\ufffd\ufffd\u0011c\ufffdF\ufffd}\ufffdx\ufffd\u0019\ufffd\ufffdD\ufffd\ufffd]\ufffd\ufffd\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73818a75f1227e350fc3fe9c13fa3c6442f26161",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\n\ufffd\u041aU\ufffd:\ufffduU\ufffd\u001e=T\ufffd\bJf\ufffd\u0409\ufffdb\ufffdV\ufffdI\u00102\ufffd\u0012 \u0000c\ufffd\ufffd\ufffd\ufffd$mP\ufffd\ufffd\ufffd\u0011c\ufffdF\ufffd}\ufffdx\ufffd\u0019\ufffd\ufffdD\ufffd\ufffd]\ufffd\ufffd\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "\ufffd?\n\ufffd\u041aU\ufffd:\ufffduU\ufffd=T\ufffdJf\ufffd\u0409\ufffdb\ufffdV\ufffdI2\ufffd c\ufffd\ufffd\ufffd\ufffd$mP\ufffd\ufffd\ufffdc\ufffdF\ufffd}\ufffdx\ufffd\ufffd\ufffdD\ufffd\ufffd]\ufffd\ufffd\ufffd zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzz\ufffd",
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003?\n\ufffd\u041aU\ufffd:\ufffduU\ufffd\u001e=T\ufffd\bJf\ufffd\u0409\ufffdb\ufffdV\ufffdI\u00102\ufffd\u0012 \u0000c\ufffd\ufffd\ufffd\ufffd$mP\ufffd\ufffd\ufffd\u0011c\ufffdF\ufffd}\ufffdx\ufffd\u0019\ufffd\ufffdD\ufffd\ufffd]\ufffd\ufffd\ufffd\u0000 zz\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "kafka probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd?\n\ufffd\u041aU\ufffd:\ufffduU\ufffd=T\ufffdJf\ufffd\u0409\ufffdb\ufffdV\ufffdI2\ufffd c\ufffd\ufffd\ufffd\ufffd$mP\ufffd\ufffd\ufffdc\ufffdF\ufffd}\ufffdx\ufffd\ufffd\ufffdD\ufffd\ufffd]\ufffd\ufffd\ufffd zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzz\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 23:40:53 UTC
TCP
8065 · Mattermost (chat d'équipe)
mattermost probe
mattermost probe · via Mattermost (chat d'équipe):8065 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
mattermost_emulated
net_mattermost_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
z v&�9,醷�ʵ�rlֵU��l ���Xw�7�� L~D�OX�Cv H��Ԝ����:U��n(3�g "�+�/̨̩�,�0� � �� � � / 5 �
Pourquoi cette classification : Type « mattermost_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
z v&�9,醷�ʵ�rlֵU��l ���Xw�7�� L~D�OX�Cv H��Ԝ����:U��n(3�g "�+�/̨̩�,�0�
� �� � � / 5 �
Requête brute (extrait)
z v&�9,醷�ʵ�rlֵU��l ���Xw�7�� L~D�OX�Cv H��Ԝ����:U��n(3�g "�+�/̨̩�,�0� � �� � � / 5 � # h2http/1.1 " 3 k i R�%�����@��n+� ����.���UU<�z A�/X� cjm�w��O�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 639,
"payload_entropy": 7.071072425232034,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "22a65a16457b2f9a4dcc124170aca506a5c34887",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "mattermost",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7928a64f8b56ee3ca7bcff1144624100",
"path_pattern_hash": "87c91dbadfbde7bdb583344421d1d34e"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003&\ufffd9,\u91b7\ufffd\u02b5\ufffdrl\u05b5U\ufffd\ufffdl\u0006\u001d\ufffd\ufffd\u0019\ufffdXw\ufffd7\ufffd\ufffd\u001f L~\u0013D\ufffd\u0019OX\ufffdCv\u000bH\ufffd\ufffd\u051c\ufffd\ufffd\ufffd\ufffd\u0005:U\ufffd\ufffdn(3\ufffdg\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003&\ufffd9,\u91b7\ufffd\u02b5\ufffdrl\u05b5U\ufffd\ufffdl\u0006\u001d\ufffd\ufffd\u0019\ufffdXw\ufffd7\ufffd\ufffd\u001f L~\u0013D\ufffd\u0019OX\ufffdCv\u000bH\ufffd\ufffd\u051c\ufffd\ufffd\ufffd\ufffd\u0005:U\ufffd\ufffdn(3\ufffdg\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 R\ufffd%\ufffd\ufffd\u0011\ufffd\ufffd\ufffd@\ufffd\ufffdn+\ufffd\u001d\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffdUU\u0001<\ufffdz\u0013\u0000\u0017\u0000A\u0004\ufffd\/X\ufffd\u000e\ncjm\ufffdw\ufffd\ufffdO\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003&\ufffd9,\u91b7\ufffd\u02b5\ufffdrl\u05b5U\ufffd\ufffdl\u0006\u001d\ufffd\ufffd\u0019\ufffdXw\ufffd7\ufffd\ufffd\u001f L~\u0013D\ufffd\u0019OX\ufffdCv\u000bH\ufffd\ufffd\u051c\ufffd\ufffd\ufffd\ufffd\u0005:U\ufffd\ufffdn(3\ufffdg\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7bb22dfbc8c5073d3731ef8c48c8fefc653c1bd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003&\ufffd9,\u91b7\ufffd\u02b5\ufffdrl\u05b5U\ufffd\ufffdl\u0006\u001d\ufffd\ufffd\u0019\ufffdXw\ufffd7\ufffd\ufffd\u001f L~\u0013D\ufffd\u0019OX\ufffdCv\u000bH\ufffd\ufffd\u051c\ufffd\ufffd\ufffd\ufffd\u0005:U\ufffd\ufffdn(3\ufffdg\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "zv&\ufffd9,\u91b7\ufffd\u02b5\ufffdrl\u05b5U\ufffd\ufffdl\ufffd\ufffd\ufffdXw\ufffd7\ufffd\ufffd L~D\ufffdOX\ufffdCvH\ufffd\ufffd\u051c\ufffd\ufffd\ufffd\ufffd:U\ufffd\ufffdn(3\ufffdg\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mattermost_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003&\ufffd9,\u91b7\ufffd\u02b5\ufffdrl\u05b5U\ufffd\ufffdl\u0006\u001d\ufffd\ufffd\u0019\ufffdXw\ufffd7\ufffd\ufffd\u001f L~\u0013D\ufffd\u0019OX\ufffdCv\u000bH\ufffd\ufffd\u051c\ufffd\ufffd\ufffd\ufffd\u0005:U\ufffd\ufffdn(3\ufffdg\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "mattermost probe \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (sonde \/ probe)",
"evidence_snippet": "zv&\ufffd9,\u91b7\ufffd\u02b5\ufffdrl\u05b5U\ufffd\ufffdl\ufffd\ufffd\ufffdXw\ufffd7\ufffd\ufffd L~D\ufffdOX\ufffdCvH\ufffd\ufffd\u051c\ufffd\ufffd\ufffd\ufffd:U\ufffd\ufffdn(3\ufffdg\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mattermost_emulated",
"net_mattermost_probe",
"tls_clienthello"
]
}
19/07/2026 23:40:44 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v4/teams HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Requête brute (extrait)
GET /api/v4/teams HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 571,
"payload_entropy": 5.577793389100288,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "23b56eaff7498f14ed367d991deca8cf",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"evidence": {
"request_sample": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=",
"payload_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f34c977cccac79faf473a45b92e528364440c42",
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v4\/teams HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}
19/07/2026 23:40:38 UTC
TCP
8065 · Mattermost (chat d'équipe)
Cross-site scripting
xss attack · via Mattermost (chat d'équipe):8065 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MATTERMOST
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mattermost_api_probe
mattermost_emulated
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8065
Chemin / cible
—
Service
Mattermost (chat d'équipe)
Payload
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 43
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1
Host: 62.3.50.33:8065
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537
Requête brute (extrait)
GET /api/v1/channels.list?count=100 HTTP/1.1 Host: 62.3.50.33:8065 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d61747465726d6f737420726561647920706f72743d383036350d0a",
"emulator_response_len": 41,
"bytes_in": 589,
"payload_entropy": 5.575912014928999,
"port_category": "registered",
"org": "3xK Tech GmbH",
"service": "mattermost",
"app_proto": "mattermost",
"asn": 200373,
"country": "GB",
"dst_port": 8065,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "dfb9202dfc0de4b93006794ca23bbee8bdcc7642",
"event_fingerprint": "22e3bf08f79bcae7110287ee11d62a54a4cd4754",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "mattermost",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 200373,
"org": "3xK Tech GmbH",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8bf151f8c0852b44814fac24c6637738",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 8065,
"service": "mattermost",
"service_name": "mattermost",
"risk_score": 43
},
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"evidence": {
"request_sample": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif",
"payload_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c46c8a54df88926ac858c4f1da96ff8863da2595",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via Mattermost (chat d'\u00e9quipe)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)",
"dst_port": 8065,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mattermost",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"port": 8065,
"service": "mattermost",
"service_label_fr": "Mattermost (chat d'\u00e9quipe)"
},
"attack_vector": "xss attack \u00b7 via Mattermost (chat d'\u00e9quipe):8065 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/v1\/channels.list?count=100 HTTP\/1.1\r\nHost: 62.3.50.33:8065\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537",
"target_port_label": "8065 \u00b7 Mattermost (chat d'\u00e9quipe)",
"emulator_service": "mattermost",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mattermost",
"service_banner": "honeypot-mattermost",
"service_os": "linux",
"dst_port": "8065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mattermost_api_probe",
"mattermost_emulated",
"mozi_pattern",
"net_mattermost_probe"
]
}