OpenCanary HTTP Form POST Login Attempt (application logtype 3001)

Alerts on OpenCanary HTTP Form POST events indicating a login attempt to an exposed service.

FreeUnreviewedSigmahighv1

opencanary-http-form-post-login-attempt-application-logtype-3001-af1ac430

title: OpenCanary HTTP Form POST Login Attempt (application logtype 3001)
id: 886245f3-5576-4828-9de0-b0fb67942c3b
status: test
description: This rule flags events from an OpenCanary node where an HTTP service receives a login attempt via an HTTP Form POST. Such POST-based authentication attempts are a common way attackers probe for valid credentials or endpoints during initial access. It relies on OpenCanary application telemetry with logtype 3001 that records these Form POST login attempts.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_http_post_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 3001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: af1ac430-df6b-4b38-b976-0b52f07a0252
    type: derived

What it detects

This rule flags events from an OpenCanary node where an HTTP service receives a login attempt via an HTTP Form POST. Such POST-based authentication attempts are a common way attackers probe for valid credentials or endpoints during initial access. It relies on OpenCanary application telemetry with logtype 3001 that records these Form POST login attempts.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.