OpenCanary Telnet Login Attempt Recorded in Application Logs
Alerts on OpenCanary Telnet login attempt events to highlight potential remote access probing.
FreeReviewedSigma · High · v5
- Product
- opencanary
- Category
- application
- Author
- Security Onion Solutions (SigmaHQ), DRL 1.1
- Published
- 2024-03-08
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when an OpenCanary node records a Telnet login attempt event. Attackers commonly probe or attempt unauthorized access over Telnet to establish initial access or persistence. The detection relies on application log telemetry from OpenCanary that includes a specific logtype value associated with Telnet login attempts.
Reporting behind it
- opencanary.readthedocs.iohttps://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- github.comhttps://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_telnet_login_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
opencanary-telnet-login-attempt-on-port-23-512cff7a
title: OpenCanary Telnet Login Attempt Recorded in Application Logs
id: 93b8f7a4-183c-4659-8595-4e12038efd37
status: test
description: This rule flags when an OpenCanary node records a Telnet login attempt event. Attackers commonly probe or attempt unauthorized access over Telnet to establish initial access or persistence. The detection relies on application log telemetry from OpenCanary that includes a specific logtype value associated with Telnet login attempts.
references:
- https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
- https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_telnet_login_attempt.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.command-and-control
- attack.stealth
- attack.t1133
- attack.t1078
logsource:
category: application
product: opencanary
detection:
selection:
logtype: 6001
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 512cff7a-683a-43ad-afe0-dd398e872f36
type: derived