OpenCanary RDP New Connection Attempt on Application Logtype 14001
Alerts on OpenCanary logging a new RDP connection attempt (logtype 14001), indicating remote access probing.
- Product
- opencanary
- Category
- application
- Author
- Marco Pedrinazzi (@pedrinazziM) (SigmaHQ), DRL 1.1
- Published
- 2026-01-06
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies RDP service activity on an OpenCanary node by matching application events where the RDP new connection logtype is recorded. Attackers may probe or attempt to access remote services, and this telemetry captures those connection attempts at the simulator level. It relies on OpenCanary application logs with logtype 14001 to confirm that an RDP connection attempt occurred.
Reporting behind it
- opencanary.readthedocs.iohttps://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- github.comhttps://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_rdp_connection_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: OpenCanary RDP New Connection Attempt on Application Logtype 14001
id: 2e2fe6a1-760c-47a2-8bf2-26d1d230666f
status: experimental
description: This rule identifies RDP service activity on an OpenCanary node by matching application events where the RDP new connection logtype is recorded. Attackers may probe or attempt to access remote services, and this telemetry captures those connection attempts at the simulator level. It relies on OpenCanary application logs with logtype 14001 to confirm that an RDP connection attempt occurred.
references:
- https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_rdp_connection_attempt.yml
author: Marco Pedrinazzi (@pedrinazziM), Huntrule Team
date: 2026-01-06
tags:
- attack.initial-access
- attack.lateral-movement
- attack.persistence
- attack.t1133
- attack.t1021.001
logsource:
category: application
product: opencanary
detection:
selection:
logtype: 14001
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 598290cf-5932-45cd-9123-be1e05ab4f2e
type: derived