{"ip":"87.251.64.50","exported_at":"2026-10-24T18:40:46+00:00","period_days":30,"metrics":{"events7d":32,"distinct_ports":7,"distinct_classifications":4,"max_severity":6,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":50,"attack_stage":"probe","attack_chain_stage":"reconnaissance","threat_family":["scanner"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":32,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP \u2014 campagne \/24 (87.251.64.0\/24)","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.251.64.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50,"correlation_boost":10},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9"],"correlation_flags_labels_fr":["Scan coordonn\u00e9"],"confidence_pct":100,"confidence_hint_fr":"Corr\u00e9lation +10","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0347","pat-0348"],"tags_summary":["pat-0347","pat-0348"],"attack_vector":"rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0003\u0000\u0000\u0026!\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000\u0003\u0000\u0001|\u0002\ufffd\ufffde\ufffd\u0001p\u0004\u0001\u0001\u0004\u0001\u0001\u0001\u0001\ufffd0\u0019\u0002\u0001\u0022\u0002\u0001\u0002\u0002\u0001\u0000\u0002\u0001\u0001\u0002\u0001\u0000\u0002\u0001\u0001\u0002\u0002\ufffd\ufffd\u0002\u0001\u00020\u0019\u0002\u0001\u0001\u0002\u0001\u0001\u0002\u0001\u0001\u0002\u0001\u0001\u0002\u0001\u0000\u0002\u0001\u0001\u0002\u0002\u0004 \u0002\u0001\u00020\u001c\u0002\u0002\ufffd\ufffd\u0002\u0002\ufffd\ufffd\u0002\u0002\ufffd\ufffd\u0002","port":3389,"service":"rdp","service_label_fr":"RDP"},"protocol_summary_fr":"Payload \u0003\u0000\u0000\u0026!\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000\u0003\u0000\u0001|\u0002\ufffd\ufffde\ufffd\u0001p\u0004\u0001\u0001\u0004\u0001\u0001\u0001\u0001\ufffd0\u0019\u0002\u0001\u2026 \u00b7 RDP:3389","evidence_snippet":"\u0026!\ufffdCookie: mstshash=\r\n|\ufffd\ufffde\ufffdp\ufffd0\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd","target_port_label":"3389 \u00b7 RDP","emulator_service":"rdp","confidence_reason":"Confiance 100 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"N\u00e9gociation protocole RDP \u00b7 confiance 100%","classification_reason_label_fr":"N\u00e9gociation protocole RDP \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10","payload_preview":"\u0026!\ufffdCookie: mstshash=\r\n|\ufffd\ufffde\ufffdp\ufffd0\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"50.64.251.87.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":5881879,"ip":"87.251.64.50","ts":"2026-10-21 09:43:55.000000","proto":"tcp","src_port":31280,"dst_port":3389,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002240bf2c34d73676fee23426938806aaa527b96fcb\u0022, \u0022event_fingerprint\u0022: \u0022ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b6bbcd364cfe1b15f0a22751dbc3d083ba94d3d5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP \u2014 campagne \/24 (87.251.64.0\/24)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3389, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Windows RDP\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.251.64.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022Windows RDP\u0022, \u0022service_os\u0022: \u0022windows\u0022, \u0022dst_port\u0022: \u00223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.251.64.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_cookie\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_cookie\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5881878,"ip":"87.251.64.50","ts":"2026-10-21 09:43:55.000000","proto":"tcp","src_port":31271,"dst_port":3389,"service":"rdp","classification":"port_3389_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aa4bea48009056c8c3884e795b29aa79232ecca7\u0022, \u0022event_fingerprint\u0022: \u0022707be242ce71f14fac23ca7fdd82d854dc2752d8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.65, \u0022classification_confidence\u0022: 0.65, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022eb3d82ddd64e24c65658a8ee92a2ad53\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228d8d4f39783aca29ac10813e5aedff8182459974\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 65, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3389, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Windows RDP\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.251.64.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022Windows RDP\u0022, \u0022service_os\u0022: \u0022windows\u0022, \u0022dst_port\u0022: \u00223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.251.64.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5878966,"ip":"87.251.64.50","ts":"2026-10-21 09:35:23.000000","proto":"tcp","src_port":57162,"dst_port":3388,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3388, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002211333e2ac29f7dfcef09b4493c3dc673186a4a67\u0022, \u0022event_fingerprint\u0022: \u002283f5ef87ea7d8eb1277bc2b5f6d31ae331c17062\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 141, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002227b0040df722a246e0eed915a54cd5962c5f0085\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3388, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223388\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5878965,"ip":"87.251.64.50","ts":"2026-10-21 09:35:23.000000","proto":"tcp","src_port":57105,"dst_port":3388,"service":"rdp","classification":"port_3388_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3388, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aec477e58f1c183580c4e59c6d675789c96fdbee\u0022, \u0022event_fingerprint\u0022: \u002283f5ef87ea7d8eb1277bc2b5f6d31ae331c17062\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00221eaff5b2cbc7ae4da9a37f80e2e2ad47\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c05b03c2e51a8f59a7f00affb6f25dc3db835577\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3388, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223388\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5877390,"ip":"87.251.64.50","ts":"2026-10-21 09:30:55.000000","proto":"tcp","src_port":6637,"dst_port":3390,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3390, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224d43a9aee13350a4f2414bd1a80e51e6af2cbed6\u0022, \u0022event_fingerprint\u0022: \u0022700e745442e0a767acc5398300bd052d20e6e907\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 141, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ce8bd0efeb8ee6ac000cc209cb1e502ac2f57b74\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3390, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223390\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5877387,"ip":"87.251.64.50","ts":"2026-10-21 09:30:55.000000","proto":"tcp","src_port":6624,"dst_port":3390,"service":"rdp","classification":"port_3390_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3390, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022556ffa544c119ec94ae6ddb83ff59318e0128f85\u0022, \u0022event_fingerprint\u0022: \u0022700e745442e0a767acc5398300bd052d20e6e907\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00221e06dc013597a552420cc3c139fe1caa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a025ccdaaaacd939ce579d6c5ccd28095832a75c\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3390, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223390\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5848703,"ip":"87.251.64.50","ts":"2026-10-21 08:42:04.000000","proto":"tcp","src_port":50866,"dst_port":3388,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3388, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002211333e2ac29f7dfcef09b4493c3dc673186a4a67\u0022, \u0022event_fingerprint\u0022: \u002283f5ef87ea7d8eb1277bc2b5f6d31ae331c17062\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 141, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002227b0040df722a246e0eed915a54cd5962c5f0085\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3388, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223388\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5848670,"ip":"87.251.64.50","ts":"2026-10-21 08:42:03.000000","proto":"tcp","src_port":50721,"dst_port":3388,"service":"rdp","classification":"port_3388_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3388, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aec477e58f1c183580c4e59c6d675789c96fdbee\u0022, \u0022event_fingerprint\u0022: \u002283f5ef87ea7d8eb1277bc2b5f6d31ae331c17062\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00221eaff5b2cbc7ae4da9a37f80e2e2ad47\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c05b03c2e51a8f59a7f00affb6f25dc3db835577\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3388, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223388\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5847148,"ip":"87.251.64.50","ts":"2026-10-21 08:40:39.000000","proto":"tcp","src_port":26981,"dst_port":3390,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3390, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224d43a9aee13350a4f2414bd1a80e51e6af2cbed6\u0022, \u0022event_fingerprint\u0022: \u0022700e745442e0a767acc5398300bd052d20e6e907\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 141, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ce8bd0efeb8ee6ac000cc209cb1e502ac2f57b74\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3390, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223390\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5847137,"ip":"87.251.64.50","ts":"2026-10-21 08:40:38.000000","proto":"tcp","src_port":26856,"dst_port":3390,"service":"rdp","classification":"port_3390_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3390, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022556ffa544c119ec94ae6ddb83ff59318e0128f85\u0022, \u0022event_fingerprint\u0022: \u0022700e745442e0a767acc5398300bd052d20e6e907\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00221e06dc013597a552420cc3c139fe1caa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a025ccdaaaacd939ce579d6c5ccd28095832a75c\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3390, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223390\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5845814,"ip":"87.251.64.50","ts":"2026-10-21 08:39:42.000000","proto":"tcp","src_port":10049,"dst_port":3389,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002240bf2c34d73676fee23426938806aaa527b96fcb\u0022, \u0022event_fingerprint\u0022: \u0022ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b6bbcd364cfe1b15f0a22751dbc3d083ba94d3d5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3389, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Windows RDP\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022Windows RDP\u0022, \u0022service_os\u0022: \u0022windows\u0022, \u0022dst_port\u0022: \u00223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_cookie\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_cookie\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5845802,"ip":"87.251.64.50","ts":"2026-10-21 08:39:41.000000","proto":"tcp","src_port":9818,"dst_port":3389,"service":"rdp","classification":"port_3389_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aa4bea48009056c8c3884e795b29aa79232ecca7\u0022, \u0022event_fingerprint\u0022: \u0022707be242ce71f14fac23ca7fdd82d854dc2752d8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022eb3d82ddd64e24c65658a8ee92a2ad53\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228d8d4f39783aca29ac10813e5aedff8182459974\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3389, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Windows RDP\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022Windows RDP\u0022, \u0022service_os\u0022: \u0022windows\u0022, \u0022dst_port\u0022: \u00223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5768521,"ip":"87.251.64.50","ts":"2026-10-21 05:49:47.000000","proto":"tcp","src_port":16442,"dst_port":3390,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3390, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224d43a9aee13350a4f2414bd1a80e51e6af2cbed6\u0022, \u0022event_fingerprint\u0022: \u0022700e745442e0a767acc5398300bd052d20e6e907\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 141, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ce8bd0efeb8ee6ac000cc209cb1e502ac2f57b74\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3390, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223390\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5768520,"ip":"87.251.64.50","ts":"2026-10-21 05:49:47.000000","proto":"tcp","src_port":16440,"dst_port":3390,"service":"rdp","classification":"port_3390_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3390, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022556ffa544c119ec94ae6ddb83ff59318e0128f85\u0022, \u0022event_fingerprint\u0022: \u0022700e745442e0a767acc5398300bd052d20e6e907\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00221e06dc013597a552420cc3c139fe1caa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a025ccdaaaacd939ce579d6c5ccd28095832a75c\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3390, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3390, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223390 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223390\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5763515,"ip":"87.251.64.50","ts":"2026-10-21 05:36:56.000000","proto":"tcp","src_port":57123,"dst_port":3389,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002240bf2c34d73676fee23426938806aaa527b96fcb\u0022, \u0022event_fingerprint\u0022: \u0022ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b6bbcd364cfe1b15f0a22751dbc3d083ba94d3d5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3389, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Windows RDP\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022Windows RDP\u0022, \u0022service_os\u0022: \u0022windows\u0022, \u0022dst_port\u0022: \u00223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_cookie\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_cookie\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5763514,"ip":"87.251.64.50","ts":"2026-10-21 05:36:56.000000","proto":"tcp","src_port":57122,"dst_port":3389,"service":"rdp","classification":"port_3389_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aa4bea48009056c8c3884e795b29aa79232ecca7\u0022, \u0022event_fingerprint\u0022: \u0022707be242ce71f14fac23ca7fdd82d854dc2752d8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022eb3d82ddd64e24c65658a8ee92a2ad53\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228d8d4f39783aca29ac10813e5aedff8182459974\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3389, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Windows RDP\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3389, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223389 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022Windows RDP\u0022, \u0022service_os\u0022: \u0022windows\u0022, \u0022dst_port\u0022: \u00223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5698816,"ip":"87.251.64.50","ts":"2026-10-21 03:17:58.000000","proto":"tcp","src_port":34908,"dst_port":3388,"service":"rdp","classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000130ed00000123400021f080000000000\u0022, \u0022emulator_response_len\u0022: 19, \u0022bytes_in\u0022: 418, \u0022payload_entropy\u0022: 2.9922676880268373, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3388, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002211333e2ac29f7dfcef09b4493c3dc673186a4a67\u0022, \u0022event_fingerprint\u0022: \u002283f5ef87ea7d8eb1277bc2b5f6d31ae331c17062\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 141, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d8555c8d696c0e3bec3d9fe66fbdeb8\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 50}, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u0002\\u0004\ufffd\\u0001\\u000f\\u0000\\u0005\\u0000\\u0014|\\u0000\\u0001\ufffd\\u0006\\u0000\\b\\u0000\\u0010\\u0000\\u0001\ufffd\\u0000Duca\ufffd\ufffd\\u0001\ufffd\ufffd\\u0000\\u0004\\u0000\\b\\u0000\ufffd\\u00078\\u0004\\u0001\ufffd\\u0003\ufffd\\t\\u0004\\u0000\\u0000(\\n\\u0000\\u0000M\\u0000S\\u0000T\\u0000S\\u0000C\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\f\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002227b0040df722a246e0eed915a54cd5962c5f0085\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022N\u00e9gociation protocole RDP \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3388, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\u0026!\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\\u0003\\u0000\\u0001|\\u0002\ufffd\ufffde\ufffd\\u0001p\\u0004\\u0001\\u0001\\u0004\\u0001\\u0001\\u0001\\u0001\ufffd0\\u0019\\u0002\\u0001\\\u0022\\u0002\\u0001\\u0002\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\ufffd\ufffd\\u0002\\u0001\\u00020\\u0019\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0001\\u0002\\u0001\\u0000\\u0002\\u0001\\u0001\\u0002\\u0002\\u0004 \\u0002\\u0001\\u00020\\u001c\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\\u0002\ufffd\ufffd\\u0002\u0022, \u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026!\ufffdCookie: mstshash=\\r\\n|\ufffd\ufffde\ufffdp\ufffd0\\\u0022\ufffd\ufffd0 0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223388\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_cookie\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":418},{"id":5698815,"ip":"87.251.64.50","ts":"2026-10-21 03:17:58.000000","proto":"tcp","src_port":34904,"dst_port":3388,"service":"rdp","classification":"port_3388_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: \u0022rdp\u0022, \u0022app_proto\u0022: \u0022rdp\u0022, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3388, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aec477e58f1c183580c4e59c6d675789c96fdbee\u0022, \u0022event_fingerprint\u0022: \u002283f5ef87ea7d8eb1277bc2b5f6d31ae331c17062\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00221eaff5b2cbc7ae4da9a37f80e2e2ad47\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c05b03c2e51a8f59a7f00affb6f25dc3db835577\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022, \u0022dst_port\u0022: 3388, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 3388, \u0022service\u0022: \u0022rdp\u0022, \u0022service_label_fr\u0022: \u0022RDP\u0022}, \u0022attack_vector\u0022: \u0022port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00223388 \u00b7 RDP\u0022, \u0022emulator_service\u0022: \u0022rdp\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rdp\u0022, \u0022service_banner\u0022: \u0022honeypot-rdp\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223388\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rdp_probe\u0022, \u0022rdp_emulated\u0022]","anomalies":"[]","severity":6,"bytes_in":0},{"id":5504122,"ip":"87.251.64.50","ts":"2026-10-20 19:37:55.000000","proto":"tcp","src_port":64304,"dst_port":13389,"service":null,"classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 47, \u0022payload_entropy\u0022: 4.155132734426204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 13389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022db4be93ce4d84b1ce0199eb582b291738f541720\u0022, \u0022event_fingerprint\u0022: \u002270f255547d5c30e9359acb13e173f226c0d11c57\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022012fca15d97ce99638a1c3f4bf953d2b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 13389, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226ab9dd461dbc9e68f76955ff171cb617d63c2dda\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 13389}, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 13389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002213389\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 13389, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 13389}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 13389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022target_port_label\u0022: \u002213389\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002213389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":47},{"id":5500899,"ip":"87.251.64.50","ts":"2026-10-20 19:28:34.000000","proto":"tcp","src_port":63498,"dst_port":33389,"service":null,"classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 47, \u0022payload_entropy\u0022: 4.155132734426204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 33389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227cab96966b6fe783fb62c899f48bf523c4583bb4\u0022, \u0022event_fingerprint\u0022: \u0022554bdaf72f1eb5c8b9cebee446c32c5c591d62fa\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022012fca15d97ce99638a1c3f4bf953d2b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 33389, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a8b73ac440698e1c79d72a10a4713f0b17cdf0a8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 33389}, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 33389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002233389\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 33389, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 33389}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 33389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022target_port_label\u0022: \u002233389\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002233389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":47},{"id":5494164,"ip":"87.251.64.50","ts":"2026-10-20 19:09:04.000000","proto":"tcp","src_port":64558,"dst_port":3391,"service":null,"classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 47, \u0022payload_entropy\u0022: 4.155132734426204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3391, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002205a8f778a57d14222720cf5bb477d3ba7ecf8638\u0022, \u0022event_fingerprint\u0022: \u0022bb6caddb49a01c9f1bc82dc1b871f0e7c56d641c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022012fca15d97ce99638a1c3f4bf953d2b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3391, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002265655dfc4b1932c478dd249f67500ae4a92da6ec\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 3391}, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 3391 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223391\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 3391, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 3391}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 3391 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022target_port_label\u0022: \u00223391\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223391\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":47},{"id":5490337,"ip":"87.251.64.50","ts":"2026-10-20 18:57:59.000000","proto":"tcp","src_port":63310,"dst_port":23389,"service":null,"classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 47, \u0022payload_entropy\u0022: 4.155132734426204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 23389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226eb708e9e077a79e932b57907f284047e47b14e1\u0022, \u0022event_fingerprint\u0022: \u0022b279f2bf0dcc12280a625c49a752b54e6105b05b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022012fca15d97ce99638a1c3f4bf953d2b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 23389, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222ca17fc865b9286563e89aa656e416976067a030\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 23389}, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 23389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002223389\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 23389, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 23389}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 23389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022target_port_label\u0022: \u002223389\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002223389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":47},{"id":5482277,"ip":"87.251.64.50","ts":"2026-10-20 18:43:40.000000","proto":"tcp","src_port":63631,"dst_port":13389,"service":null,"classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 47, \u0022payload_entropy\u0022: 4.155132734426204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 13389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022db4be93ce4d84b1ce0199eb582b291738f541720\u0022, \u0022event_fingerprint\u0022: \u002270f255547d5c30e9359acb13e173f226c0d11c57\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022012fca15d97ce99638a1c3f4bf953d2b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 13389, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226ab9dd461dbc9e68f76955ff171cb617d63c2dda\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 13389}, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 13389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002213389\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 13389, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 13389}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 13389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022target_port_label\u0022: \u002213389\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002213389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":47},{"id":5479695,"ip":"87.251.64.50","ts":"2026-10-20 18:36:27.000000","proto":"tcp","src_port":64669,"dst_port":33389,"service":null,"classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 47, \u0022payload_entropy\u0022: 4.155132734426204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 33389, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227cab96966b6fe783fb62c899f48bf523c4583bb4\u0022, \u0022event_fingerprint\u0022: \u0022554bdaf72f1eb5c8b9cebee446c32c5c591d62fa\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022012fca15d97ce99638a1c3f4bf953d2b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 33389, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a8b73ac440698e1c79d72a10a4713f0b17cdf0a8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 33389}, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 33389 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002233389\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 33389, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 33389}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 33389 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022target_port_label\u0022: \u002233389\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002233389\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":47},{"id":5471494,"ip":"87.251.64.50","ts":"2026-10-20 18:13:10.000000","proto":"tcp","src_port":65494,"dst_port":3391,"service":null,"classification":"rdp_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 47, \u0022payload_entropy\u0022: 4.155132734426204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 212835, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3391, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002205a8f778a57d14222720cf5bb477d3ba7ecf8638\u0022, \u0022event_fingerprint\u0022: \u0022bb6caddb49a01c9f1bc82dc1b871f0e7c56d641c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 116, \u0022precision_signals\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP NTLM hash\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 212835, \u0022org\u0022: \u0022Shesternin Vladimir Anatolievich\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022012fca15d97ce99638a1c3f4bf953d2b\u0022, \u0022path_pattern_hash\u0022: \u00225dd788b551ee7afb63321e74cfc538f6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3391, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002265655dfc4b1932c478dd249f67500ae4a92da6ec\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 3391}, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 3391 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223391\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 3391, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0347\u0022, \u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0003\\u0000\\u0000\/*\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000Cookie: mstshash=Administr\\r\\n\\u0001\\u0000\\b\\u0000\\u0003\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 3391}, \u0022attack_vector\u0022: \u0022rdp probe \u00b7 port 3391 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\/*\ufffdCookie: mstshash=Administr\u0022, \u0022target_port_label\u0022: \u00223391\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223391\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":47}],"total_events":32}