huntrule

OpenCanary RDP Service: New Connection Attempt Logged

Alerts on OpenCanary logging a new RDP connection attempt (logtype 14001), indicating remote access probing.

FreeUnreviewedSigmahighv1
title: "OpenCanary RDP Service: New Connection Attempt Logged"
id: 2e2fe6a1-760c-47a2-8bf2-26d1d230666f
status: experimental
description: This rule flags when an OpenCanary node records a new inbound connection attempt against its RDP service. Attackers often probe remote-access endpoints to identify reachable services and validate access paths. The detection relies on OpenCanary application telemetry, specifically the RDP connection event indicated by logtype 14001.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_rdp_connection_attempt.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
  - attack.initial-access
  - attack.lateral-movement
  - attack.persistence
  - attack.t1133
  - attack.t1021.001
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 14001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 598290cf-5932-45cd-9123-be1e05ab4f2e
    type: derived

What it detects

This rule flags when an OpenCanary node records a new inbound connection attempt against its RDP service. Attackers often probe remote-access endpoints to identify reachable services and validate access paths. The detection relies on OpenCanary application telemetry, specifically the RDP connection event indicated by logtype 14001.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.