huntrule

OpenCanary NMAP NULL Scan Targeting (Logtype 5003)

Detects OpenCanary logtype 5003 events consistent with NMAP NULL scan targeting.

FreeUnreviewedSigmahighv1
title: OpenCanary NMAP NULL Scan Targeting (Logtype 5003)
id: 3686e3ee-4b0f-47f2-8925-df9870dc8c9b
status: experimental
description: This rule flags OpenCanary events indicating the monitored node was targeted by an NMAP NULL scan. Such scans are used by attackers to perform host/service discovery while attempting to minimize detectable scan signatures. Detection relies on OpenCanary application telemetry where log entries with logtype 5003 represent this specific scan behavior.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_portscan_nmap_null_scan.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 5003
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 68b8547b-107f-43f3-97fb-900a7d63c190
    type: derived

What it detects

This rule flags OpenCanary events indicating the monitored node was targeted by an NMAP NULL scan. Such scans are used by attackers to perform host/service discovery while attempting to minimize detectable scan signatures. Detection relies on OpenCanary application telemetry where log entries with logtype 5003 represent this specific scan behavior.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.