huntrule

OpenCanary NMAP OS Scan Targeting via Application Logtype 5002

Alerts when OpenCanary records an NMAP OS scan event (logtype 5002), indicating host fingerprinting activity.

FreeUnreviewedSigmahighv1
title: OpenCanary NMAP OS Scan Targeting via Application Logtype 5002
id: 3c25c156-c7ac-47fc-b6f4-3fd124af6cc0
status: experimental
description: This rule flags OpenCanary instances that have been targeted by an NMAP OS scan. OS scanning is used to fingerprint a host’s operating system to support follow-on exploitation and more accurate targeting. The detection relies on OpenCanary application telemetry where events with logtype 5002 indicate the NMAP OS scan behavior.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_portscan_nmap_os_scan.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 5002
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e8a677fd-248c-4eab-94df-de2f6f645884
    type: derived

What it detects

This rule flags OpenCanary instances that have been targeted by an NMAP OS scan. OS scanning is used to fingerprint a host’s operating system to support follow-on exploitation and more accurate targeting. The detection relies on OpenCanary application telemetry where events with logtype 5002 indicate the NMAP OS scan behavior.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.