OpenCanary HTTPPROXY Login Attempt Proxy Request

Alerts on OpenCanary HTTPPROXY events indicating a proxy request for another page.

FreeUnreviewedSigmahighv1

opencanary-httpproxy-login-attempt-proxy-request-5498fc09

title: OpenCanary HTTPPROXY Login Attempt Proxy Request
id: 96284676-0fad-4447-8986-b947edb65535
status: test
description: This rule flags OpenCanary application logs where the HTTPPROXY service records a proxy attempt for another page. Such events may indicate an attacker interacting with the proxy-facing component to access or relay content. Detection relies on OpenCanary application telemetry where the event is identified by the logtype value associated with these proxy login attempts.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_httpproxy_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.initial-access
  - attack.command-and-control
  - attack.t1090
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 7001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 5498fc09-adc6-4804-b9d9-5cca1f0b8760
    type: derived

What it detects

This rule flags OpenCanary application logs where the HTTPPROXY service records a proxy attempt for another page. Such events may indicate an attacker interacting with the proxy-facing component to access or relay content. Detection relies on OpenCanary application telemetry where the event is identified by the logtype value associated with these proxy login attempts.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.