20/06/2026 04:43:24 UTC
TCP
9700 · HTTP
Sonde port 9700/TCP
port 9700 tcp · via HTTP:9700 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9700
Chemin / cible
/
Preuve honeypot — Sonde port 9700/TCP
Connexion détectée sur le port 9700 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9700_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9700
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9700 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "0a0b8f448e59191d2da0c04ca939bed628dedb35",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.124776292821557,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 9700,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "7ceec9c19eb56120d03429ffd84efc7e0e1d4ad2",
"event_fingerprint": "77cfab64377309dd3eb8655da1b34c30ac91c831",
"classification_reason": "Type \u00ab port_9700_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "999234f6cf54c2fe5a0b254e3c0debb8",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9700,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9700\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9700\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9700\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9700\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9700\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_9700_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6469ee483821e6f78970de0586903f7ddeaec4a6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9700,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9700\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 9700 tcp \u00b7 via HTTP:9700 \u00b7 (sonde \/ probe)",
"target_port_label": "9700 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9700_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_9700_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9700,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9700,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9700 tcp \u00b7 via HTTP:9700 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9700\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "9700 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9700"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:41:10 UTC
TCP
8069 · HTTP
Sonde port 8069/TCP
port 8069 tcp · via HTTP:8069 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8069
Chemin / cible
/
Preuve honeypot — Sonde port 8069/TCP
Connexion détectée sur le port 8069 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8069_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8069
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8069 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "fd5683efc6609daf201e9937445ddcdc997e0072",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.129946755165142,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8069,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "334395bc2d26a5e940999f289d06be29259e8092",
"event_fingerprint": "15c9ee969aadcd721030e665b20898fab1182aaf",
"classification_reason": "Type \u00ab port_8069_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "99159e2dde1a1cb356615faf9b792840",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8069,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8069\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8069\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8069\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8069\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8069\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_8069_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96834a705e75f1d1df75de718d15666af0b9f48f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 8069,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8069\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 8069 tcp \u00b7 via HTTP:8069 \u00b7 (sonde \/ probe)",
"target_port_label": "8069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8069_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_8069_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8069,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 8069,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8069 tcp \u00b7 via HTTP:8069 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8069\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "8069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8069"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
20/06/2026 04:37:09 UTC
TCP
12207 · HTTP
Sonde port 12207/TCP
port 12207 tcp · via HTTP:12207 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12207
Chemin / cible
/
Preuve honeypot — Sonde port 12207/TCP
Connexion détectée sur le port 12207 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_12207_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:12207
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:12207 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "558f3cf7d407369dda1c7697eadd6baf51c0ca0a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.102041053565556,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 12207,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "e0e446b78f07250d9208e5c2a67c0673d6f37b06",
"event_fingerprint": "da94e403a0b06a2af2cab27e99b50be3878976c0",
"classification_reason": "Type \u00ab port_12207_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "16e46c99cb1d56bc37009f3653bbab2a",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 12207,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12207\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12207\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12207\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12207\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12207\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "Type \u00ab port_12207_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "836f9f9979b2c9beabb94d6f7b2dffd1dbce03cc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 12207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12207\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"attack_vector": "port 12207 tcp \u00b7 via HTTP:12207 \u00b7 (sonde \/ probe)",
"target_port_label": "12207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_12207_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_12207_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12207,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 12207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 12207 tcp \u00b7 via HTTP:12207 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12207\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"target_port_label": "12207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:34:35 UTC
TCP
9433 · HTTP
Sonde port 9433/TCP
port 9433 tcp · via HTTP:9433 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9433
Chemin / cible
/
Preuve honeypot — Sonde port 9433/TCP
Connexion détectée sur le port 9433 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9433_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9433
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9433 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "edefaac50acfb8167db14b53188fafa9db25e40f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.105907200340986,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 9433,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "ec95a733d0b0b6756f8d36988285c846a012f059",
"event_fingerprint": "909c69bf9acc5a6d744425f9acd072b0094ff335",
"classification_reason": "Type \u00ab port_9433_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "a317a5c4bf99ed9191f3bb4ba660efdf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9433,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9433\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9433\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9433\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9433\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9433\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_9433_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e5a6ec81cf7371168b14edb8c0ec2044b2732ee0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9433,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9433\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 9433 tcp \u00b7 via HTTP:9433 \u00b7 (sonde \/ probe)",
"target_port_label": "9433 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9433_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_9433_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9433,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9433,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9433 tcp \u00b7 via HTTP:9433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9433\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "9433 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:34:13 UTC
TCP
5272 · HTTP
Sonde port 5272/TCP
port 5272 tcp · via HTTP:5272 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5272
Chemin / cible
/
Preuve honeypot — Sonde port 5272/TCP
Connexion détectée sur le port 5272 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5272_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5272
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5272 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "aacfae0b96f56cd210ecb8dc74e2c79e341b0932",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.091524560134753,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 5272,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "b9e35b020de22b4c67452ba45fe7813fe65f43a6",
"event_fingerprint": "786ff2bd50edc5a81db2119c4e8a79f80ab397a8",
"classification_reason": "Type \u00ab port_5272_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "35b497f3709ab08d7a3056a71a610821",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5272,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5272\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5272\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5272\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5272\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5272\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_5272_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93d078f9e5bb6e092d4d224cb2ac0dfa2bae3318",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 5272,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5272\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 5272 tcp \u00b7 via HTTP:5272 \u00b7 (sonde \/ probe)",
"target_port_label": "5272 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5272_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_5272_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5272,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 5272,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 5272 tcp \u00b7 via HTTP:5272 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5272\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "5272 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5272"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:28:31 UTC
TCP
2087 · HTTP
Sonde port 2087/TCP
port 2087 tcp · via HTTP:2087 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2087
Chemin / cible
/
Preuve honeypot — Sonde port 2087/TCP
Connexion détectée sur le port 2087 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2087_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2087
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2087 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "f632b4de18b92074e4c6a166d9c86de50717ec9c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.121418587371742,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 2087,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 30
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "859af6e3689e5266f328e9aa910131927518c8c6",
"event_fingerprint": "30df77face6ffcbfcaa254e1d821da4cf2a734c8",
"classification_reason": "Type \u00ab port_2087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 30,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "c0a1efa38fa64b283a4120c0b30dab09",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2087,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2087\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2087\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2087\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2087\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2087\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_2087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ee5994b5074c377c62710ceeac01e24453e8be8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 2087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2087\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 2087 tcp \u00b7 via HTTP:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_2087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 30,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 2087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2087 tcp \u00b7 via HTTP:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2087\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "2087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:19:36 UTC
TCP
3176 · HTTP
Sonde port 3176/TCP
port 3176 tcp · via HTTP:3176 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3176
Chemin / cible
/
Preuve honeypot — Sonde port 3176/TCP
Connexion détectée sur le port 3176 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3176_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3176
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3176 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "e0b19f5b6c45ecf30ba5e3ec81211cc7602a1b5a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.100052727928154,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 3176,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "0a6ce94b078d9dc0e3d6856353c3abca1d3e3239",
"event_fingerprint": "18851d1a859aab63742eda87d5c7d3255ded5908",
"classification_reason": "Type \u00ab port_3176_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "7c7fe9487016cd1a49409e636e167a53",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3176,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3176\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3176\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3176\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3176\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3176\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_3176_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e2f23413a3d24e6c66270109bcc3a2d87fe37a8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3176,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3176\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 3176 tcp \u00b7 via HTTP:3176 \u00b7 (sonde \/ probe)",
"target_port_label": "3176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3176_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3176_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3176,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3176,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3176 tcp \u00b7 via HTTP:3176 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3176\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "3176 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3176"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:13:56 UTC
TCP
25082 · HTTP
Sonde port 25082/TCP
port 25082 tcp · via HTTP:25082 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
25082
Chemin / cible
/
Preuve honeypot — Sonde port 25082/TCP
Connexion détectée sur le port 25082 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_25082_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:25082
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:25082 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "7cb7847d21c967201de1137e219ecd44e2add310",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.102041053565556,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 25082,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "e0a3e5545157794dde52e4de818ef294a48acd8b",
"event_fingerprint": "a81f3cd584f1716bfc88485ca2a8b695765e80f6",
"classification_reason": "Type \u00ab port_25082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "b9716b055843e51195949cd20731361d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 25082,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25082\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25082\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25082\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25082\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25082\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "Type \u00ab port_25082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "999b019e156493a9d337fa080cc2e0c9b0d0cdbb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 25082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25082\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"attack_vector": "port 25082 tcp \u00b7 via HTTP:25082 \u00b7 (sonde \/ probe)",
"target_port_label": "25082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_25082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_25082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 25082,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 25082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 25082 tcp \u00b7 via HTTP:25082 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25082\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"target_port_label": "25082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "25082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:08:43 UTC
TCP
9058 · HTTP
Sonde port 9058/TCP
port 9058 tcp · via HTTP:9058 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9058
Chemin / cible
/
Preuve honeypot — Sonde port 9058/TCP
Connexion détectée sur le port 9058 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9058_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9058
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9058 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "311f1e788e6df1d5237f28c83620e191797dadc2",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.124776292821557,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 9058,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "98d5ad90bc9ac60c26987f6cdcf3d32985fed97a",
"event_fingerprint": "4bcf4a7bbdb7069aa8974871063bebd000fbd711",
"classification_reason": "Type \u00ab port_9058_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "cb54aef4c9d860c687b7597c0404edf7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9058,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9058\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9058\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9058\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9058\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9058\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_9058_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2668e5d7e92abad3ff0f8f680f0c9764cbe408c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9058,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9058\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 9058 tcp \u00b7 via HTTP:9058 \u00b7 (sonde \/ probe)",
"target_port_label": "9058 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9058_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_9058_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9058,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9058,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9058 tcp \u00b7 via HTTP:9058 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9058\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "9058 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9058"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
20/06/2026 04:05:02 UTC
TCP
9595 · HTTP
Sonde port 9595/TCP
port 9595 tcp · via HTTP:9595 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9595
Chemin / cible
/
Preuve honeypot — Sonde port 9595/TCP
Connexion détectée sur le port 9595 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9595_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9595
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9595 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.1025494948911705,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 9595,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "ce0159b93c3d55424381011ff78a0c232aac8692",
"event_fingerprint": "250d2bba796a9c315c8c788e0052838689f0d72e",
"classification_reason": "Type \u00ab port_9595_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "52f64c980331e7185ce4852185771b44",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9595,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "Type \u00ab port_9595_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd55def839ae441c2093d138b8cc79d2cc0d2dd4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"attack_vector": "port 9595 tcp \u00b7 via HTTP:9595 \u00b7 (sonde \/ probe)",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9595_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_9595_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9595,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9595 tcp \u00b7 via HTTP:9595 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:55:31 UTC
TCP
12499
Scanner web
Élevée
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12499
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:12499
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:12499 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "4523f1be64122960c1873f82e33d07cb1465a4b9",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.126596430942677,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 12499,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 19,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "446b8a6bc18aa23ca0686d274f2e4ae5ad09e296",
"event_fingerprint": "2803d90d50ce5793074add520c91597aca826123",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "4f1cc3fa31c21787e46f7d5421ac44e5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 12499,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12499\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12499\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12499\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12499\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12499\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70f2cffe5f697ead28d25fc503054f9015f872e6",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:33:34 UTC
TCP
11110
Scanner web
Élevée
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
11110
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:11110
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:11110 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "f224204dab6f2581d177f0543c22d1bbb1afa99e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.075509526151339,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 11110,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 20,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "720f96d453927b1da21a914fa6ddba88a7120393",
"event_fingerprint": "8adf75275909add8be5c71403ff25c096035c1b0",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "46858a35cf144c7af8528ddc8f39d434",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 11110,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11110\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11110\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11110\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11110\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11110\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "95bde5b379be491f5741a1392376966a24569cc3",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:24:54 UTC
TCP
9611
Scanner web
Élevée
Faible · 18
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9611
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9611
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9611 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "046622c0d920b05466ec85219bee1af9a28baf0e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.1025494948911705,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 9611,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 18,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "c977869bed8d15505b8d3152071d368c3f9d8da2",
"event_fingerprint": "4686ce3bbb9e618160cf6b7faf4221739fb5a4ad",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "8d10dfdadb9481f49c0eaa79bca1be27",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9611,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9611\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9611\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9611\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9611\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9611\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31282634aa26e1757d0d54d244c7570a6e684a5b",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:23:16 UTC
TCP
10533
Scanner web
Élevée
Faible · 22
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10533
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:10533
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:10533 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "7afab2038e799af6e16ca3c9b9ac0675e4f305c5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.078844390067482,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 10533,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 22,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "e83bfe495e19c04f29a1722115c831b98d15b442",
"event_fingerprint": "2bc8e8a33748786d79ec7721c4de9f2e047d85ef",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "819dcc149d9d70e8f0cb5a7b091e73a7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 10533,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10533\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10533\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10533\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10533\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10533\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "302f5245833f6f71a08b8513d995e1e453c4b9da",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:18:16 UTC
TCP
591
Scanner web
Élevée
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
591
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:591
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connectio
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:591 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "d63885d1f1b06da9a39b56d573e583c2216d3a11",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 5.095412991072187,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 591,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 19,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "698147b8d41b365e3564a90718ce59fe8b085d01",
"event_fingerprint": "1e7d365cc1f5089a65fcad7aa72675aa08f14799",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "60cd4961e57c4b68f7ab8e03f2a72b02",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 591,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnectio",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnectio",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:591\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnectio",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "758e75666e9d6ea3e1b19aedcdd8f6692ac97d40",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:07:21 UTC
TCP
30113
Scanner web
Élevée
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
30113
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:30113
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:30113 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "840eb2bcdf7c600a0bd1e2f32d77542e98262424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.075509526151339,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 30113,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 20,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "ea5bf446bc9500e3f4f2b2e29358dc3a3b7a1b7d",
"event_fingerprint": "b3a0315a5d587236ab53e898dc6e59ae8fb49017",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "948c3144f2398673e9a8437f18aa8865",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 30113,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30113\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30113\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30113\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30113\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:30113\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b050615658a1c9f27f02f68f0ad58a0e246a77fc",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:05:25 UTC
TCP
22609
Scanner web
Élevée
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
22609
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:22609
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:22609 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "4e0f2f3837b3197102be62d08c148df270e666ec",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.107176342695921,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 22609,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 20,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "1806265d45be189debea1ddd457ad5043523b061",
"event_fingerprint": "586dbfe48a0721f4bbb273e14f0f276343e551fe",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "3d430d5e2a6d946dc4360f4b9bb60137",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 22609,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22609\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22609\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22609\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22609\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22609\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aead4427a1c22f4f37229180a6f8eb0b9271e3ae",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:01:21 UTC
TCP
8156
Scanner web
Élevée
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8156
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8156
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connecti
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8156 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "202b0f5b4802d60e421d402e83e055ee2b3dc0c9",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.105907200340986,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8156,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 19,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "858ce42164f8e72740c981b7a8492c02bde26dab",
"event_fingerprint": "43768bc8578a08316f3c937a082be6b7705254bb",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "bd0812c9d7e22c460934da95f9af9026",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8156,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8156\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8156\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8156\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8156\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8156\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnecti",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a37cbc3d4202ec688be699937e20b097e7864ac3",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 06:01:09 UTC
TCP
10205
Scanner web
Élevée
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10205
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:10205
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate
Accept: */*
Connect
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:10205 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "870dce7c1087253c320adce74b0aa4af7af8ff03",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.089114968328208,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 10205,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 20
},
"risk_score": 19,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "5091ffcdc154e796ea60a718b82a1e3322b205ab",
"event_fingerprint": "8941002d5c431568cc9194a1e0ff234c146d5e9c",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "90925aa04369759fcf1b09b7db5af839",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 10205,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10205\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10205\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10205\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10205\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10205\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnect",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ead33655ac3505452d7c5fd1a6ff24dc64bcc10",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
],
"asn_dc_heuristic": true
}
05/06/2026 02:05:48 UTC
TCP
445
Sonde SMB
Élevée
Faible · 25
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_smb_probe
smb_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
445
Chemin / cible
—
Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
E�SMBr � �� " NT LM 0.12 SMB 2.002 SMB 2.???
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000048",
"emulator_response_len": 4,
"bytes_in": 73,
"payload_entropy": 3.3885789371896085,
"port_category": "well_known",
"org": "Google LLC",
"service": "smb",
"app_proto": "smb",
"asn": 396982,
"country": "BE",
"dst_port": 445,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 25,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "90eadff6383eb9d1d8f3257adde4c79c467b3287",
"event_fingerprint": "c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eadaad3b8e7f063ddff8b862fcb3b89e",
"path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504"
},
"target_context": {
"dst_port": 445,
"service": "smb"
},
"payload_preview": "\u0000\u0000\u0000E\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000",
"request_sample": "\u0000\u0000\u0000E\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000",
"payload_snippet": "\u0000\u0000\u0000E\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000E\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000",
"payload_snippet": "\u0000\u0000\u0000E\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a006854bab7982c982812a46ae16e36a46fcbf4f",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_smb_probe",
"smb_emulated"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:21 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ��S � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ��S � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "561e58ce7493363fc232991bdcf72450",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\ufffd\u0019S\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd\u0019S\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd\u0019S\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd\u0019S\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd\u0019S\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d4023d9c89085efa8b83bf33d69580d043ed9d2",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:21 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ��s1 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ��s1 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.651825864814236,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7abd68036599b433473cb6aa1bea4318",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\ufffds1\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffds1\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffds1\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffds1\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffds1\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42e61405e669b3e67088eff4d5b2b987facf0e49",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:20 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �9o � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �9o � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.666564163667069,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "702fdd80aa24eca6ef4d588353e7841c",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\u00129o\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\u00129o\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\u00129o\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\u00129o\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\u00129o\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d96965a0129132b4f95cdbc81bed4dd39bfec196",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:19 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: � �3 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: � �3 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.670883150065817,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dfc781ffd7c9f8235c39903c6f6b568d",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\f\ufffd3\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\f\ufffd3\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\f\ufffd3\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\f\ufffd3\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\f\ufffd3\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ec85b3b9bcf275938b2df3ad1a454d809235805",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:19 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �!�$ � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �!�$ � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.6760093936149785,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e8303eaf7ab10f8104e6a70ca2a452c9",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd!\ufffd$\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd!\ufffd$\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd!\ufffd$\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd!\ufffd$\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd!\ufffd$\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8342f78f6a4fd57724ecf61991c761d943ad1784",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:18 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: Zv�? � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: Zv�? � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.670883150065817,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5c88c303cc34b3b9711b33d53b600780",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000Zv\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000Zv\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000Zv\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000Zv\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000Zv\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7bdb0c971ea0c5be11122a39f7f242d64f2171e6",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:18 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ^VB � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ^VB � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c814e01d531165eae6a3fac201ad144d",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000^VB\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000^VB\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000^VB\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000^VB\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000^VB\u0005\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bcdc57933174449ccbec7c30c75557c3221d0098",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:17 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �
�m � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: � �m � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.669188662882251,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d0cc03fc835b8c8a2c593fcc5619fe46",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\r\ufffdm\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\r\ufffdm\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\r\ufffdm\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\r\ufffdm\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\r\ufffdm\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9930d59fb229299215520d61c30be3592beddb5",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:17 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: E��, � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: E��, � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "248c274b5770c58a452a680a922a8bed",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000E\ufffd\ufffd,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000E\ufffd\ufffd,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000E\ufffd\ufffd,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000E\ufffd\ufffd,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000E\ufffd\ufffd,\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb08402a9477a25d85733a8162823dabf2813749",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 2,
"behavior_priority": 72
}
04/06/2026 22:05:16 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ��� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ��� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f31499f0d48f6bc9f7670254f3db2acd",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0012\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0012\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0012\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0012\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0012\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "775d59e9206b1a383a8e63cd6e17f2d28ac0c39a",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:15 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ݖ� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ݖ� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ad417847947d67077fe7fbdafbd58f9",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\u0756\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\u0756\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u0756\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\u0756\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u0756\ufffd\u000f\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b58771794f3d72e89b702fb398998969d9fb03d8",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:15 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ?� a � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ?� a � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.667442654965638,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cfccc2efa7c28e39b6490ddf2f589919",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000?\ufffd\u001ca\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000?\ufffd\u001ca\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000?\ufffd\u001ca\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000?\ufffd\u001ca\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000?\ufffd\u001ca\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0929342cc68bd4d3624954e60c63f15381583d1d",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:14 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �~� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �~� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b83b80f3a759fd10ca0814c443da0ba5",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd~\ufffd\u001b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd~\ufffd\u001b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd~\ufffd\u001b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd~\ufffd\u001b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd~\ufffd\u001b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "da7ece9f65876b0eddbcc7c9e6b2bc295dbedcb0",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:14 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: � Ky � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: � Ky � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.665674640437154,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3c967c47892847f0cd4c8b0c2152eb59",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\tKy\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\tKy\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\tKy\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\tKy\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\tKy\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef077aa9d97769c8f08f0b26753d03c1e29c7ca4",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:13 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ��Q- � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ��Q- � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.6760093936149785,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e6a0c6253a0af4afef8e41a105f26fbb",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\ufffdQ-\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffdQ-\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffdQ-\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffdQ-\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffdQ-\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "67b9938eb303a3f9ab9ce9be629e57a1a9550eea",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:13 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �1== � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �1== � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.665674640437154,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "57225b315c8b2e775f0c5f1a7921536f",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd1==\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd1==\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd1==\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd1==\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd1==\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a5373995440f2222fcf1ab00c494e1e9f63b898c",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:12 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: F � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: F � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.6760093936149785,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ad22bd9da9ae30350ff3880be36f0d7",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000F\u0015\u001f\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000F\u0015\u001f\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000F\u0015\u001f\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000F\u0015\u001f\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000F\u0015\u001f\u000b\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5365f679dc1dd50cd1afe05dcd836e0277c32770",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:11 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: S� " � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: S� " � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.669639966863385,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e38101c0cc7f5fd956961b972f8d9279",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000S\ufffd\u000b\"\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000S\ufffd\u000b\"\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000S\ufffd\u000b\"\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000S\ufffd\u000b\"\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000S\ufffd\u000b\"\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33abf2c2dae6972b8acac59d9eae23437faeb231",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:11 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: c5 � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: c5 � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.646699621265074,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0cec1f3ba7c400509ab58e54f6eb399f",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\u0001\u0007c5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\u0001\u0007c5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u0001\u0007c5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\u0001\u0007c5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u0001\u0007c5\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb903910363a7d4330bdd82430efb24396fbcb10",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:10 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ���? � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ���? � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25ba40ad9d61ae28b869fdfb13516d93",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd\ufffd?\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2c59f9037fc1cee7f2c3ad1401bc3556ce6b5a2",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:10 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: !�� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: !�� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.6760093936149785,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a4ad5f3a653f32736d7bcd90ac6b087e",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000!\ufffd\ufffd\u0017\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000!\ufffd\ufffd\u0017\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000!\ufffd\ufffd\u0017\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000!\ufffd\ufffd\u0017\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000!\ufffd\ufffd\u0017\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "126335ac4227d8ad612f3f6fe3910cde40cee7c7",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:09 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: @�i � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: @�i � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.656229410489245,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9dcf5cf60bfecdef4298d54df83f8666",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000@\u0007\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000@\u0007\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000@\u0007\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000@\u0007\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000@\u0007\ufffdi\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "191603c6fcb2903c7fae5fbc93e8d91703a135d6",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:09 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �h� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �h� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.65846233946107,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ef227a20c91168d1670e529cd23aa2d4",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffdh\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffdh\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffdh\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffdh\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffdh\ufffd\u0003\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a58f87f8ffc9d82e6fb34d0e90990a30f9705894",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:08 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ͏� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ͏� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.6760093936149785,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "04ab2f10bc518f5594b4f9d1f4348215",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\u034f\ufffd\t\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\u034f\ufffd\t\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u034f\ufffd\t\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\u034f\ufffd\t\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u034f\ufffd\t\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77caad85ed8be1fbbe89d08b2afd03336f50661c",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:08 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �,j � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �,j � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.68237882036657,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "960226f6d00ba68b766a85fa1f8351b6",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\u000f\ufffd,j\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\u000f\ufffd,j\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u000f\ufffd,j\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\u000f\ufffd,j\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\u000f\ufffd,j\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43e0dc8fb1edfba9b6b4a99bcbf839da45daee24",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:07 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �+]B � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �+]B � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.6760093936149785,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1a8edca908af209787817315353e8240",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd+]B\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd+]B\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd+]B\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd+]B\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd+]B\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28dca8bd61d66d4dad662d8aa71002caf6f7d4e1",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:06 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: uKS> � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: uKS> � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.670883150065815,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7ce1a4858d2c03ae6259276b69d5a3b2",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000uKS>\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000uKS>\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000uKS>\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000uKS>\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000uKS>\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d44d2c1fc619531164e35aecccea043237bbca1",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:06 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: ��_< � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: ��_< � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.6760093936149785,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "501cde133abef7eab56405fad7ec5415",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\ufffd\ufffd_<\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd_<\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd_<\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\ufffd\ufffd_<\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\ufffd\ufffd_<\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9dbbf67e0dc0f1b27476c40b25d8b192e7d8bdf9",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:05 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: �} � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: �} � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.669639966863385,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "65119b308f1dcffc0dd24e9f601ead62",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000\b\u000b\ufffd}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000\b\u000b\ufffd}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\b\u000b\ufffd}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000\b\u000b\ufffd}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000\b\u000b\ufffd}\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "939118341eb9b605b305571de75c662db83b91b9",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}
04/06/2026 22:05:05 UTC
TCP
27017
Protocole wire MongoDB
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
mongodb_emulated
mongodb_hello_probe
mongodb_wire_protocol
net_bruteforce_burst
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
27017
Chemin / cible
—
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mongo isMaster legacy
Mongo ismaster command
NFS RPC mount
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
: K'� � admin.$cmd ���� ismaster helloOk client � driver - name
PyMongo|c version 4.13
Requête brute (extrait)
: K'� � admin.$cmd ���� ismaster helloOk client � driver - name PyMongo|c version 4.13.2 os T type Linux name Linux architecture x86_64 version 6.12.68+ platform CPython 3.13.3.final.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 314,
"payload_entropy": 4.657084127409848,
"port_category": "registered",
"org": "Google LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 396982,
"country": "BE",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c4ac3118d7473e99ee83d670158aed2aa3dc390c",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 206,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"pat-0363",
"pat-0364",
"INT-upstream"
],
"matched_patterns": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mongo isMaster legacy",
"Mongo ismaster command",
"NFS RPC mount",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0363",
"pat-0364",
"pat-0532",
"pat-0554",
"pat-0536"
],
"classification_parent": "mongodb_probe",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d84604961da50ef4ed6cf8881f527746",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb"
},
"payload_preview": ":\u0001\u0000\u0000K'\ufffd\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"request_sample": ":\u0001\u0000\u0000K'\ufffd\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000K'\ufffd\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"evidence": {
"request_sample": ":\u0001\u0000\u0000K'\ufffd\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.68+\u0000\u0000\u0002platform\u0000\u0017\u0000\u0000\u0000CPython 3.13.3.final.0",
"payload_snippet": ":\u0001\u0000\u0000K'\ufffd\u0000\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0013\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000\ufffd\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "688fa59cb3eda8730e70acb562616edf65cc151a",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_emulated",
"mongodb_hello_probe",
"mongodb_wire_protocol",
"net_bruteforce_burst",
"net_mongodb_wire_protocol",
"rdp_cookie_alt"
],
"asn_dc_heuristic": true
}