OpenCanary RDP New Connection Attempt on Application Logtype 14001

Alerts on OpenCanary logging a new RDP connection attempt (logtype 14001), indicating remote access probing.

FreeReviewedSigma · High · v5

Product: opencanary
Category: application
Author: Marco Pedrinazzi (@pedrinazziM) (SigmaHQ), DRL 1.1
Published: 2026-01-06
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Lateral Movement

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.001Remote Desktop Protocol
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies RDP service activity on an OpenCanary node by matching application events where the RDP new connection logtype is recorded. Attackers may probe or attempt to access remote services, and this telemetry captures those connection attempts at the simulator level. It relies on OpenCanary application logs with logtype 14001 to confirm that an RDP connection attempt occurred.

Reporting behind it

Related detections9 linkedT1021.001 — drag to rearrange

Windows: User Added to Local Remote Desktop Users Group via Net or PowerShell

Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)

Suspicious TermService ServiceDll Hijack via Registry (via registry_set)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible PAN-OS CVE-2026-0257 Exploitation via GlobalProtect PoC Artifacts (via network)

Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation

Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware

Malicious RDP Tunneling via ngrok (via process_creation)

Suspicious Remote Desktop Enablement via Registry By Ransomware

OpenCanary RDP New Connection Attempt on Application Logtype 14001

Pivot detection · T1021.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

opencanary-rdp-service-new-connection-attempt-logged-598290cf

title: OpenCanary RDP New Connection Attempt on Application Logtype 14001
id: 2e2fe6a1-760c-47a2-8bf2-26d1d230666f
status: experimental
description: This rule identifies RDP service activity on an OpenCanary node by matching application events where the RDP new connection logtype is recorded. Attackers may probe or attempt to access remote services, and this telemetry captures those connection attempts at the simulator level. It relies on OpenCanary application logs with logtype 14001 to confirm that an RDP connection attempt occurred.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_rdp_connection_attempt.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
  - attack.initial-access
  - attack.lateral-movement
  - attack.persistence
  - attack.t1133
  - attack.t1021.001
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 14001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 598290cf-5932-45cd-9123-be1e05ab4f2e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL