OpenCanary FTP Login Attempt on Port 2000
Flags OpenCanary application events indicating an FTP login attempt on a monitored node.
FreeReviewedSigma · High · v5
- Product
- opencanary
- Category
- application
- Author
- Security Onion Solutions (SigmaHQ), DRL 1.1
- Published
- 2024-03-08
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags OpenCanary events indicating a login attempt against an FTP service on an OpenCanary node. Attackers may probe or try credentials via FTP to gain initial access or expand reach for follow-on activity. It relies on OpenCanary application telemetry where FTP login attempts are recorded as events with a matching logtype value.
Reporting behind it
- opencanary.readthedocs.iohttps://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- github.comhttps://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ftp_login_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
opencanary-ftp-login-attempt-activity-6991bc2b
title: OpenCanary FTP Login Attempt on Port 2000
id: 0148fb52-daea-4bf1-805c-ed8effc63a05
status: test
description: This rule flags OpenCanary events indicating a login attempt against an FTP service on an OpenCanary node. Attackers may probe or try credentials via FTP to gain initial access or expand reach for follow-on activity. It relies on OpenCanary application telemetry where FTP login attempts are recorded as events with a matching logtype value.
references:
- https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ftp_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
- attack.initial-access
- attack.exfiltration
- attack.lateral-movement
- attack.t1190
- attack.t1021
logsource:
category: application
product: opencanary
detection:
selection:
logtype: 2000
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5
type: derived