OpenCanary SMB service records file open requests

Triggers when OpenCanary logs an SMB file open request to its monitored host.

FreeReviewedSigma · High · v5

Product: opencanary
Category: application
Author: Security Onion Solutions (SigmaHQ), DRL 1.1
Published: 2024-03-08
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021Remote Services
Collection
- T1005Data from Local System
C2
Exfiltration
Impact

What it detects

This rule flags when an OpenCanary node handling SMB receives a file open request. Such events can indicate attempted SMB enumeration or access attempts used for collection and lateral movement. The detection relies on OpenCanary application telemetry where file open activity is logged as logtype 5000.

Reporting behind it

Related detections9 linkedT1005 — drag to rearrange

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

Suspicious Browser and Wallet Credential Theft via JavaScript Stealer

Suspicious WhatsAppBackup Data Staging Archive Creation

Suspicious Environment File Credential Search via findstr (via process_creation)

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry by BlackByte Ransomware

Suspicious RDP Bitmap Cache Temp Files Written by mstsc in Rogue RDP Campaign (via file_event)

Suspicious Azure CLI Disk Snapshot and Copy for Data Theft

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

OpenCanary SMB service records file open requests

Pivot detection · T1005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

opencanary-smb-file-open-request-observed-22777c9e

title: OpenCanary SMB service records file open requests
id: 564190bd-169f-47a2-8dbc-a8cc3c59bef0
status: test
description: This rule flags when an OpenCanary node handling SMB receives a file open request. Such events can indicate attempted SMB enumeration or access attempts used for collection and lateral movement. The detection relies on OpenCanary application telemetry where file open activity is logged as logtype 5000.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_smb_file_open.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.lateral-movement
  - attack.collection
  - attack.t1021
  - attack.t1005
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 5000
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 22777c9e-873a-4b49-855f-6072ab861a52
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL