OpenCanary HTTP GET Request Received on Service Port

Alerts when OpenCanary logs an HTTP GET request to a monitored service endpoint.

FreeUnreviewedSigmahighv1

opencanary-http-get-request-received-on-service-port-af6c3078

title: OpenCanary HTTP GET Request Received on Service Port
id: 5d8796a0-b4a2-4498-8bf5-ae7c2c6f1c8f
status: test
description: This rule flags OpenCanary instances that log an inbound HTTP GET request to a monitored service. Such GET traffic can indicate probing or initial discovery as an attacker attempts to reach or interact with a web endpoint. The detection relies on OpenCanary application logs where HTTP requests are recorded, matching entries with the specific log type used for recorded GET events.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_http_get.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 3000
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: af6c3078-84cd-4c68-8842-08b76bd81b13
    type: derived

What it detects

This rule flags OpenCanary instances that log an inbound HTTP GET request to a monitored service. Such GET traffic can indicate probing or initial discovery as an attacker attempts to reach or interact with a web endpoint. The detection relies on OpenCanary application logs where HTTP requests are recorded, matching entries with the specific log type used for recorded GET events.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.