OpenCanary SMB File Open Request Observed

Triggers when OpenCanary logs an SMB file open request to its monitored host.

FreeUnreviewedSigmahighv1

opencanary-smb-file-open-request-observed-22777c9e

title: OpenCanary SMB File Open Request Observed
id: 564190bd-169f-47a2-8dbc-a8cc3c59bef0
status: test
description: This rule flags OpenCanary events where an SMB service on an OpenCanary node receives a file open request. Attackers may use SMB interactions to access or stage data during collection or lateral movement attempts. Detection relies on OpenCanary application telemetry for SMB request logging, specifically events with logtype 5000.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_smb_file_open.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.lateral-movement
  - attack.collection
  - attack.t1021
  - attack.t1005
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 5000
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 22777c9e-873a-4b49-855f-6072ab861a52
    type: derived

What it detects

This rule flags OpenCanary events where an SMB service on an OpenCanary node receives a file open request. Attackers may use SMB interactions to access or stage data during collection or lateral movement attempts. Detection relies on OpenCanary application telemetry for SMB request logging, specifically events with logtype 5000.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.