OpenCanary Redis Action Command Attempt

Alerts when OpenCanary reports an attempted action command against its Redis service.

FreeUnreviewedSigmahighv1

opencanary-redis-action-command-attempt-547dfc53

title: OpenCanary Redis Action Command Attempt
id: 11174bf6-9c22-4d70-a328-882f58de1c91
status: test
description: This rule flags OpenCanary application telemetry indicating that a Redis service on an OpenCanary node had an action command attempted. Attackers may attempt Redis commands to enumerate data, test connectivity, or progress collection before further exploitation. The detection relies on OpenCanary event logs with a matching logtype value for action-command attempts.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_redis_command.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1003
  - attack.t1213
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 17001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 547dfc53-ebf6-4afe-8d2e-793d9574975d
    type: derived

What it detects

This rule flags OpenCanary application telemetry indicating that a Redis service on an OpenCanary node had an action command attempted. Attackers may attempt Redis commands to enumerate data, test connectivity, or progress collection before further exploitation. The detection relies on OpenCanary event logs with a matching logtype value for action-command attempts.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.