OpenCanary - TFTP Service Request Observed

Alerts on OpenCanary logs showing a recorded request to the TFTP service.

FreeUnreviewedSigmahighv1

opencanary-tftp-service-request-observed-b4e6b016

title: OpenCanary - TFTP Service Request Observed
id: 2c640409-ab82-4055-83a4-b75bcd61e8ee
status: test
description: This rule flags when an OpenCanary node records an observed request to its TFTP service. Attackers may use TFTP for file transfer and staging, so unsolicited TFTP activity can indicate scanning or attempted exfiltration workflows. The detection relies on OpenCanary application logs containing the specific logtype that corresponds to TFTP requests.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_tftp_request.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 10001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: b4e6b016-a2ac-4759-ad85-8000b300d61e
    type: derived

What it detects

This rule flags when an OpenCanary node records an observed request to its TFTP service. Attackers may use TFTP for file transfer and staging, so unsolicited TFTP activity can indicate scanning or attempted exfiltration workflows. The detection relies on OpenCanary application logs containing the specific logtype that corresponds to TFTP requests.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.