OpenCanary application logs: SSH new connection attempt on monitored node
Alerts when OpenCanary records a new SSH connection attempt to a monitored node.
FreeReviewedSigma · High · v5
- Product
- opencanary
- Category
- application
- Author
- Security Onion Solutions (SigmaHQ), DRL 1.1
- Published
- 2024-03-08
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags OpenCanary telemetry indicating that an SSH service on a monitored node received a new connection attempt. Attackers commonly probe SSH endpoints to identify reachable services and facilitate further access or movement. The detection relies on OpenCanary application logs where the SSH connection event is recorded as logtype 4000.
Reporting behind it
- opencanary.readthedocs.iohttps://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- github.comhttps://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ssh_new_connection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
opencanary-detects-new-ssh-connection-attempts-on-monitored-nodes-cd55f721
title: "OpenCanary application logs: SSH new connection attempt on monitored node"
id: f488f61d-35c4-498f-9940-86f6ed7ae597
status: test
description: This rule flags OpenCanary telemetry indicating that an SSH service on a monitored node received a new connection attempt. Attackers commonly probe SSH endpoints to identify reachable services and facilitate further access or movement. The detection relies on OpenCanary application logs where the SSH connection event is recorded as logtype 4000.
references:
- https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ssh_new_connection.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.lateral-movement
- attack.persistence
- attack.stealth
- attack.t1133
- attack.t1021
- attack.t1078
logsource:
category: application
product: opencanary
detection:
selection:
logtype: 4000
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: cd55f721-5623-4663-bd9b-5229cab5237d
type: derived