OpenCanary NTP Monlist Request Observed
Alerts when an OpenCanary node’s NTP service logs an NTP monlist request.
FreeReviewedSigma · High · v5
- Product
- opencanary
- Category
- application
- Author
- Security Onion Solutions (SigmaHQ), DRL 1.1
- Published
- 2024-03-08
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags OpenCanary telemetry where an NTP service has logged an NTP monlist request. Attackers may use NTP monitoring/listing behavior to enumerate or probe time services, which can provide intelligence or lead to further abuse. It relies on OpenCanary application logs indicating the specific event type associated with monlist requests.
Reporting behind it
- opencanary.readthedocs.iohttps://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- github.comhttps://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ntp_monlist.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
opencanary-ntp-service-monlist-request-logged-7cded4b3
title: OpenCanary NTP Monlist Request Observed
id: 208ca05c-d2b2-4f57-972c-a3debfe72b58
status: test
description: This rule flags OpenCanary telemetry where an NTP service has logged an NTP monlist request. Attackers may use NTP monitoring/listing behavior to enumerate or probe time services, which can provide intelligence or lead to further abuse. It relies on OpenCanary application logs indicating the specific event type associated with monlist requests.
references:
- https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ntp_monlist.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
- attack.impact
- attack.t1498
logsource:
category: application
product: opencanary
detection:
selection:
logtype: 11001
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 7cded4b3-f09e-405a-b96f-24248433ba44
type: derived