huntrule

OpenCanary MSSQL SQLAuth Login Attempt Detected

Flags MSSQL SQLAuth login attempts recorded by OpenCanary for credential-access style activity.

FreeUnreviewedSigmahighv1
title: OpenCanary MSSQL SQLAuth Login Attempt Detected
id: a8aeb3f2-32e8-47ec-af41-6a0576e19e93
status: test
description: Identifies OpenCanary nodes where an MSSQL service recorded a login attempt using SQLAuth (logtype 9001). This matters because repeated or unauthorized SQL authentication attempts are consistent with credential access and password guessing against an exposed database service. The detection relies on OpenCanary application telemetry indicating SQLAuth login activity for the MSSQL service.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_mssql_login_sqlauth.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1003
  - attack.t1213
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 9001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd
    type: derived

What it detects

Identifies OpenCanary nodes where an MSSQL service recorded a login attempt using SQLAuth (logtype 9001). This matters because repeated or unauthorized SQL authentication attempts are consistent with credential access and password guessing against an exposed database service. The detection relies on OpenCanary application telemetry indicating SQLAuth login activity for the MSSQL service.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.