OpenCanary Detects New SSH Connection Attempts on Monitored Nodes

title: OpenCanary Detects New SSH Connection Attempts on Monitored Nodes
id: f488f61d-35c4-498f-9940-86f6ed7ae597
status: test
description: This rule flags OpenCanary-generated application events indicating an SSH service on a monitored node received a new connection attempt. Attackers probing for reachable SSH endpoints commonly scan for exposed services and may use the result to plan further access or lateral movement. The detection relies on OpenCanary telemetry where SSH connection attempts are emitted as log records with a specific logtype value.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ssh_new_connection.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.lateral-movement
  - attack.persistence
  - attack.stealth
  - attack.t1133
  - attack.t1021
  - attack.t1078
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 4000
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: cd55f721-5623-4663-bd9b-5229cab5237d
    type: derived