OpenCanary NTP Service Monlist Request Logged

Alerts when an OpenCanary node’s NTP service logs an NTP monlist request.

FreeUnreviewedSigmahighv1

opencanary-ntp-service-monlist-request-logged-7cded4b3

title: OpenCanary NTP Service Monlist Request Logged
id: 208ca05c-d2b2-4f57-972c-a3debfe72b58
status: test
description: This rule flags OpenCanary instances where the NTP service has recorded an NTP monlist request. Attackers may use NTP monlist functionality to enumerate or gather information about the target’s NTP service. Detection relies on OpenCanary application logs with the specific logtype value corresponding to the monlist request event.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ntp_monlist.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.impact
  - attack.t1498
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 11001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 7cded4b3-f09e-405a-b96f-24248433ba44
    type: derived

What it detects

This rule flags OpenCanary instances where the NTP service has recorded an NTP monlist request. Attackers may use NTP monlist functionality to enumerate or gather information about the target’s NTP service. Detection relies on OpenCanary application logs with the specific logtype value corresponding to the monlist request event.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.