Client performs a full RTSP interaction sequence — OPTIONS, DESCRIBE, SETUP, and PLAY — indicating an attempt to initialize and access a media stream. This pattern reflects active interaction with a streaming service rather than simple probing, and is commonly seen when automated tools or unauthorized clients try to view exposed camera or RTSP feeds.

Identifies RDP clients attempting authentication using the legacy RDP security mode where credentials are exchanged through the older RDP security layer instead of Network Level Authentication (NLA). This indicates the client negotiated legacy plaintext authentication during the RDP security handshake

Enumerates MongoDB server metadata and storage characteristics across multiple databases by issuing commands such as buildInfo, serverStatus, hostInfo, features, and isMaster, followed by systematic dbStats and collStats queries against common databases including admin, config, local, test, and production. This behavior reflects structured reconnaissance intended to map server capabilities, deployment topology, and data footprint prior to potential follow-on actions.

Client sends RTSP OPTIONS requests to check supported methods and confirm that an RTSP service is exposed, then disconnects without attempting authentication or stream setup. This pattern is typically associated with automated reconnaissance or internet-wide scanning rather than active stream access.