OpenCanary Application Telemetry: SYN Port Scan Targeting a Host

Flags OpenCanary events indicating the host was probed with a TCP SYN port scan.

FreeUnreviewedSigmahighv1

opencanary-application-telemetry-syn-port-scan-targeting-a-host-974be8d2

title: "OpenCanary Application Telemetry: SYN Port Scan Targeting a Host"
id: 527b7d7d-130c-44ce-9397-081ed5b0560a
status: experimental
description: This rule identifies when an OpenCanary node is targeted by a TCP SYN port scan. A SYN scan is commonly used during reconnaissance to quickly infer which ports are reachable without completing a full connection. It relies on OpenCanary application logs where matching activity is recorded under logtype 5001.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_portscan_syn_scan.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 5001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 974be8d2-283e-4033-ab08-7505b84204d0
    type: derived

What it detects

This rule identifies when an OpenCanary node is targeted by a TCP SYN port scan. A SYN scan is commonly used during reconnaissance to quickly infer which ports are reachable without completing a full connection. It relies on OpenCanary application logs where matching activity is recorded under logtype 5001.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.