Platform / product
opencanary Sigma detection rules
24 community-maintained Sigma detection rules in the library target the opencanary platform, covering log sources such as application. Browse by severity, inspect the detection logic and MITRE ATT&CK mapping, and open the original Sigma YAML before using a rule in your detection engineering workflow.
Log sources
Severity
OpenCanary - FTP Login Attempt
highDetects instances where an FTP service on an OpenCanary node has had a login attempt.
opencanary · application
OpenCanary - GIT Clone Request
highDetects instances where a GIT service on an OpenCanary node has had Git Clone request.
opencanary · application
OpenCanary - Host Port Scan (SYN Scan)
highDetects instances where an OpenCanary node has been targeted by a SYN port scan.
opencanary · application
OpenCanary - HTTP GET Request
highDetects instances where an HTTP service on an OpenCanary node has received a GET request.
opencanary · application
OpenCanary - HTTP POST Login Attempt
highDetects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.
opencanary · application
OpenCanary - HTTPPROXY Login Attempt
highDetects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.
opencanary · application
OpenCanary - MSSQL Login Attempt Via SQLAuth
highDetects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
opencanary · application
OpenCanary - MSSQL Login Attempt Via Windows Authentication
highDetects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
opencanary · application
OpenCanary - MySQL Login Attempt
highDetects instances where a MySQL service on an OpenCanary node has had a login attempt.
opencanary · application
OpenCanary - NMAP FIN Scan
highDetects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
opencanary · application
OpenCanary - NMAP NULL Scan
highDetects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
opencanary · application
OpenCanary - NMAP OS Scan
highDetects instances where an OpenCanary node has been targeted by a NMAP OS Scan
opencanary · application
OpenCanary - NMAP XMAS Scan
highDetects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan
opencanary · application
OpenCanary - NTP Monlist Request
highDetects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
opencanary · application
OpenCanary - RDP New Connection Attempt
highDetects instances where an RDP service on an OpenCanary node has had a connection attempt.
opencanary · application
OpenCanary - REDIS Action Command Attempt
highDetects instances where a REDIS service on an OpenCanary node has had an action command attempted.
opencanary · application
OpenCanary - SIP Request
highDetects instances where an SIP service on an OpenCanary node has had a SIP request.
opencanary · application
OpenCanary - SMB File Open Request
highDetects instances where an SMB service on an OpenCanary node has had a file open request.
opencanary · application
OpenCanary - SNMP OID Request
highDetects instances where an SNMP service on an OpenCanary node has had an OID request.
opencanary · application
OpenCanary - SSH Login Attempt
highDetects instances where an SSH service on an OpenCanary node has had a login attempt.
opencanary · application
OpenCanary - SSH New Connection Attempt
highDetects instances where an SSH service on an OpenCanary node has had a connection attempt.
opencanary · application
OpenCanary - Telnet Login Attempt
highDetects instances where a Telnet service on an OpenCanary node has had a login attempt.
opencanary · application
OpenCanary - TFTP Request
highDetects instances where a TFTP service on an OpenCanary node has had a request.
opencanary · application
OpenCanary - VNC Connection Attempt
highDetects instances where a VNC service on an OpenCanary node has had a connection attempt.
opencanary · application