huntrule

OpenCanary Network Service Logs: Nmap Xmas Scan Targeting Detection

Detects OpenCanary log events showing an Nmap Xmas scan targeting the monitored node.

FreeUnreviewedSigmahighv1
title: "OpenCanary Network Service Logs: Nmap Xmas Scan Targeting Detection"
id: 7066665c-62cc-4ca3-afa6-7865ee3a9d14
status: experimental
description: This rule flags events in OpenCanary application logs indicating that an OpenCanary node was targeted by an Nmap Xmas scan. Xmas scanning is used during network discovery and can help attackers identify exposed hosts and services by probing uncommon TCP flag combinations. The detection relies on OpenCanary telemetry with a specific event logtype value indicating an Xmas scan attempt.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_portscan_nmap_xmas_scan.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 5004
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d7553d7b-f485-479c-b192-cdac6edd83a4
    type: derived

What it detects

This rule flags events in OpenCanary application logs indicating that an OpenCanary node was targeted by an Nmap Xmas scan. Xmas scanning is used during network discovery and can help attackers identify exposed hosts and services by probing uncommon TCP flag combinations. The detection relies on OpenCanary telemetry with a specific event logtype value indicating an Xmas scan attempt.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.