OpenCanary FTP Login Attempt Activity

Flags OpenCanary application events indicating an FTP login attempt on a monitored node.

FreeUnreviewedSigmahighv1

opencanary-ftp-login-attempt-activity-6991bc2b

title: OpenCanary FTP Login Attempt Activity
id: 0148fb52-daea-4bf1-805c-ed8effc63a05
status: test
description: This rule alerts when an OpenCanary node records an FTP login attempt event from its application telemetry. FTP login attempts are a common step in initial access and later movement, where attackers probe credentials or endpoints to gain connectivity. The detection relies on OpenCanary application logs with the specific event identifier used to represent FTP login activity.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ftp_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.initial-access
  - attack.exfiltration
  - attack.lateral-movement
  - attack.t1190
  - attack.t1021
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 2000
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5
    type: derived

What it detects

This rule alerts when an OpenCanary node records an FTP login attempt event from its application telemetry. FTP login attempts are a common step in initial access and later movement, where attackers probe credentials or endpoints to gain connectivity. The detection relies on OpenCanary application logs with the specific event identifier used to represent FTP login activity.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.