OpenCanary SNMP OID Requests Observed on Node

Alerts when OpenCanary records an SNMP OID request to its SNMP service.

FreeReviewedSigma · High · v5

Product: opencanary
Category: application
Author: Security Onion Solutions (SigmaHQ), DRL 1.1
Published: 2024-03-08
Updated: 2026-07-31

ATT&CK techniques

Discovery → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
Lateral Movement
- T1021Remote Services
Collection
C2
Exfiltration
Impact

What it detects

Identifies when an OpenCanary node records an SNMP service event indicating an OID request was received. This can reflect attacker reconnaissance or service probing aimed at learning system details exposed via SNMP. The rule relies on OpenCanary application telemetry that logs SNMP OID request events by a specific logtype.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

OpenCanary SNMP OID Requests Observed on Node

Pivot detection · T1016 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

opencanary-snmp-oid-request-observed-e9856028

title: OpenCanary SNMP OID Requests Observed on Node
id: fed7c20a-fd32-47f1-bb59-0355388c3bae
status: test
description: Identifies when an OpenCanary node records an SNMP service event indicating an OID request was received. This can reflect attacker reconnaissance or service probing aimed at learning system details exposed via SNMP. The rule relies on OpenCanary application telemetry that logs SNMP OID request events by a specific logtype.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_snmp_cmd.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.discovery
  - attack.lateral-movement
  - attack.t1016
  - attack.t1021
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 13001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e9856028-fd4e-46e6-b3d1-10f7ceb95078
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL