OpenCanary Application Logs: SSH Login Attempt on Monitoring Node
Alerts on recorded SSH login attempts from OpenCanary application logs (logtype 4002).
FreeReviewedSigma · High · v5
- Product
- opencanary
- Category
- application
- Author
- Security Onion Solutions (SigmaHQ), DRL 1.1
- Published
- 2024-03-08
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when an OpenCanary node reports an SSH service login attempt in its application telemetry. Such attempts may indicate automated probing, credential guessing, or tenant-to-tenant movement attempts against exposed services. Detection relies on OpenCanary application log events with a specific logtype value that corresponds to recorded SSH login attempts.
Reporting behind it
- opencanary.readthedocs.iohttps://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- github.comhttps://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ssh_login_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
opencanary-ssh-login-attempt-on-application-log-events-ff7139bc
title: "OpenCanary Application Logs: SSH Login Attempt on Monitoring Node"
id: e9a95e69-8179-4ad3-a726-711136a23233
status: test
description: This rule flags when an OpenCanary node reports an SSH service login attempt in its application telemetry. Such attempts may indicate automated probing, credential guessing, or tenant-to-tenant movement attempts against exposed services. Detection relies on OpenCanary application log events with a specific logtype value that corresponds to recorded SSH login attempts.
references:
- https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_ssh_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.lateral-movement
- attack.persistence
- attack.stealth
- attack.t1133
- attack.t1021
- attack.t1078
logsource:
category: application
product: opencanary
detection:
selection:
logtype: 4002
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: ff7139bc-fdb1-4437-92f2-6afefe8884cb
type: derived