huntrule

OpenCanary MySQL Service Login Attempt

Flags OpenCanary events indicating a MySQL service login attempt on the monitored node.

FreeUnreviewedSigmahighv1
title: OpenCanary MySQL Service Login Attempt
id: 5582e212-209e-4012-aafb-9905e4543d9c
status: test
description: This rule identifies OpenCanary nodes that record a login attempt against a MySQL service. Attackers frequently probe authentication to validate credentials or enumerate accessible services, making repeated login attempts a useful indicator of unauthorized access attempts. Detection relies on OpenCanary application telemetry where the MySQL login attempt event is logged with the matching log type value.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_mysql_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1003
  - attack.t1213
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 8001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e7d79a1b-25ed-4956-bd56-bd344fa8fd06
    type: derived

What it detects

This rule identifies OpenCanary nodes that record a login attempt against a MySQL service. Attackers frequently probe authentication to validate credentials or enumerate accessible services, making repeated login attempts a useful indicator of unauthorized access attempts. Detection relies on OpenCanary application telemetry where the MySQL login attempt event is logged with the matching log type value.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.