OpenCanary SIP Request Activity (application logs)

title: OpenCanary SIP Request Activity (application logs)
id: 691b324d-0e47-43bf-b9a0-7540df3aefe0
status: test
description: This rule flags when an OpenCanary node records a SIP request for its SIP service. Attackers may probe SIP endpoints to enumerate exposed services, validate network reachability, or identify misconfigurations. The detection relies on OpenCanary application logs with a specific logtype value that indicates SIP request activity.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_sip_request.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.collection
  - attack.t1123
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 15001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e30de276-68ec-435c-ab99-ef3befec6c61
    type: derived