OpenCanary
Telemetry Evidence
These values show how indexed rules identify OpenCanary telemetry.Sigma
opencanary
Detection Rules
Sigma #
- OpenCanary - FTP Login Attempt source high: Detects instances where an FTP service on an OpenCanary node has had a login attempt.
T1021,T1190 - OpenCanary - GIT Clone Request source high: Detects instances where a GIT service on an OpenCanary node has had Git Clone request.
T1213 - OpenCanary - Host Port Scan (SYN Scan) source high: Detects instances where an OpenCanary node has been targeted by a SYN port scan.
T1046 - OpenCanary - HTTP GET Request source high: Detects instances where an HTTP service on an OpenCanary node has received a GET request.
T1190 - OpenCanary - HTTP POST Login Attempt source high: Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.
T1190 - OpenCanary - HTTPPROXY Login Attempt source high: Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.
T1090 - OpenCanary - MSSQL Login Attempt Via SQLAuth source high: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
T1003,T1213 - OpenCanary - MSSQL Login Attempt Via Windows Authentication source high: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
T1003,T1213 - OpenCanary - MySQL Login Attempt source high: Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
T1003,T1213 - OpenCanary - NMAP FIN Scan source high: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
T1046
Show 14 more
- OpenCanary - NMAP NULL Scan source high: Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
T1046 - OpenCanary - NMAP OS Scan source high: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan
T1046 - OpenCanary - NMAP XMAS Scan source high: Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan
T1046 - OpenCanary - NTP Monlist Request source high: Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
T1498 - OpenCanary - RDP New Connection Attempt source high: Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
T1021,T1021.001,T1133 - OpenCanary - REDIS Action Command Attempt source high: Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
T1003,T1213 - OpenCanary - SIP Request source high: Detects instances where an SIP service on an OpenCanary node has had a SIP request.
T1123 - OpenCanary - SMB File Open Request source high: Detects instances where an SMB service on an OpenCanary node has had a file open request.
T1005,T1021 - OpenCanary - SNMP OID Request source high: Detects instances where an SNMP service on an OpenCanary node has had an OID request.
T1016,T1021 - OpenCanary - SSH Login Attempt source high: Detects instances where an SSH service on an OpenCanary node has had a login attempt.
T1021,T1078,T1133 - OpenCanary - SSH New Connection Attempt source high: Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
T1021,T1078,T1133 - OpenCanary - Telnet Login Attempt source high: Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
T1078,T1133 - OpenCanary - TFTP Request source high: Detects instances where a TFTP service on an OpenCanary node has had a request.
T1041 - OpenCanary - VNC Connection Attempt source high: Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
T1021