OpenCanary TFTP Service Receives a Request

Alerts on OpenCanary logs showing a recorded request to the TFTP service.

FreeReviewedSigma · High · v5

Product: opencanary
Category: application
Author: Security Onion Solutions (SigmaHQ), DRL 1.1
Published: 2024-03-08
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1041Exfiltration Over C2 Channel
Impact

What it detects

Identifies OpenCanary nodes where the TFTP service logs a request event. Attackers may use TFTP for unauthenticated file transfer during initial access or exfiltration attempts, making service request activity an important signal. This rule relies on OpenCanary application telemetry with logtype 10001 indicating that the TFTP service handled a request.

Reporting behind it

Related detections9 linkedT1041 — drag to rearrange

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

Malicious PowerShell Exfiltration to webhook.site Following WSUS Exploitation

Suspicious InvisibleFerret C2 Endpoints over Port 1224 (via proxy)

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

Suspicious DEEPPOST Data Exfiltration URI Pattern via BrazenBamboo

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

Suspicious COOKIE SPIDER macOS Data Exfiltration via curl Archive Upload (via process_creation)

Suspicious Watering Hole Exfiltration to Fake wp-includes Endpoint via SilentSelfie

OpenCanary TFTP Service Receives a Request

Pivot detection · T1041 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

opencanary-tftp-service-request-observed-b4e6b016

title: OpenCanary TFTP Service Receives a Request
id: 2c640409-ab82-4055-83a4-b75bcd61e8ee
status: test
description: Identifies OpenCanary nodes where the TFTP service logs a request event. Attackers may use TFTP for unauthenticated file transfer during initial access or exfiltration attempts, making service request activity an important signal. This rule relies on OpenCanary application telemetry with logtype 10001 indicating that the TFTP service handled a request.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_tftp_request.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 10001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: b4e6b016-a2ac-4759-ad85-8000b300d61e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL