OpenCanary SNMP OID Request Observed

title: OpenCanary SNMP OID Request Observed
id: fed7c20a-fd32-47f1-bb59-0355388c3bae
status: test
description: This rule flags OpenCanary logs indicating an SNMP service on an OpenCanary node received an OID request. SNMP OID queries can be used for device and service discovery, making unexpected requests relevant to recon and probing activity. The detection relies on OpenCanary application telemetry entries matching the specified logtype value for OID requests.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_snmp_cmd.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.discovery
  - attack.lateral-movement
  - attack.t1016
  - attack.t1021
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 13001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e9856028-fd4e-46e6-b3d1-10f7ceb95078
    type: derived