OpenCanary Telnet Login Attempt on Port 23

title: OpenCanary Telnet Login Attempt on Port 23
id: 93b8f7a4-183c-4659-8595-4e12038efd37
status: test
description: This rule flags OpenCanary application telemetry indicating a Telnet login attempt on an OpenCanary node. Telnet login activity can represent probing for exposed access paths and is commonly used to test default credentials or weak authentication. It relies on OpenCanary logs with logtype value 6001 that correspond to Telnet login attempts.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_telnet_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.command-and-control
  - attack.stealth
  - attack.t1133
  - attack.t1078
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 6001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 512cff7a-683a-43ad-afe0-dd398e872f36
    type: derived