OpenCanary - Nmap FIN Scan Targeting Detection (Application Logtype 5005)

Detects Nmap FIN scan targeting against an OpenCanary node using application logs with logtype 5005.

FreeUnreviewedSigmahighv1

opencanary-nmap-fin-scan-targeting-detection-application-logtype-5005-eae8c0c8

title: OpenCanary - Nmap FIN Scan Targeting Detection (Application Logtype 5005)
id: bfb7c413-36e6-423d-be7f-90587fcfc018
status: experimental
description: This rule flags OpenCanary events where the node is targeted by an Nmap FIN scan. FIN scans are used during reconnaissance to probe whether network ports are accessible while aiming to evade simpler detection. The detection relies on OpenCanary application logs and specifically matches events recorded with logtype 5005.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_portscan_nmap_fin_scan.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 5005
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: eae8c0c8-e5da-450a-9d7d-66aa56cd26b6
    type: derived

What it detects

This rule flags OpenCanary events where the node is targeted by an Nmap FIN scan. FIN scans are used during reconnaissance to probe whether network ports are accessible while aiming to evade simpler detection. The detection relies on OpenCanary application logs and specifically matches events recorded with logtype 5005.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.