huntrule

OpenCanary MSSQL Windows Authentication Login Attempt

Alerts on OpenCanary MSSQL events where Windows Authentication login attempts are observed.

FreeUnreviewedSigmahighv1
title: OpenCanary MSSQL Windows Authentication Login Attempt
id: 50d33b3f-5401-4272-acb7-fc376bd84604
status: test
description: This rule flags OpenCanary logs indicating an MSSQL service on a monitored node received a login attempt using Windows Authentication. Attackers may use Windows credentials or Windows auth flows to gain access to exposed database services. The detection relies on OpenCanary application telemetry where the logtype value 9002 records the Windows authentication login attempt event.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_mssql_login_winauth.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1003
  - attack.t1213
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 9002
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 6e78f90f-0043-4a01-ac41-f97681613a66
    type: derived

What it detects

This rule flags OpenCanary logs indicating an MSSQL service on a monitored node received a login attempt using Windows Authentication. Attackers may use Windows credentials or Windows auth flows to gain access to exposed database services. The detection relies on OpenCanary application telemetry where the logtype value 9002 records the Windows authentication login attempt event.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.