Every published rule

Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files

Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.

OpenCanary VNC Connection Attempt Observed

Alerts when OpenCanary records a VNC service connection attempt on an instrumented node.

OpenCanary TFTP Service Receives a Request

Alerts on OpenCanary logs showing a recorded request to the TFTP service.

OpenCanary Telnet Login Attempt Recorded in Application Logs

Alerts on OpenCanary Telnet login attempt events to highlight potential remote access probing.

OpenCanary application logs: SSH new connection attempt on monitored node

Alerts when OpenCanary records a new SSH connection attempt to a monitored node.

OpenCanary Application Logs: SSH Login Attempt on Monitoring Node

Alerts on recorded SSH login attempts from OpenCanary application logs (logtype 4002).

OpenCanary SNMP OID Requests Observed on Node

Alerts when OpenCanary records an SNMP OID request to its SNMP service.

OpenCanary SMB service records file open requests

Triggers when OpenCanary logs an SMB file open request to its monitored host.

OpenCanary SIP Request on Honeypot Node

Alerts on OpenCanary logs showing SIP request activity on a configured SIP service.

OpenCanary Redis Action Command Attempt

Alerts when OpenCanary reports an attempted action command against its Redis service.

OpenCanary NTP Monlist Request Observed

Alerts when an OpenCanary node’s NTP service logs an NTP monlist request.

OpenCanary MySQL Service: Login Attempt Recorded

Flags OpenCanary events indicating a MySQL service login attempt on the monitored node.

OpenCanary: MSSQL Windows Authentication Login Attempt (Logtype 9002)

Alerts on OpenCanary MSSQL events where Windows Authentication login attempts are observed.

OpenCanary MSSQL SQLAuth Login Attempt Detected (logtype 9001)

Flags MSSQL SQLAuth login attempts recorded by OpenCanary for credential-access style activity.

OpenCanary HTTPPROXY Login Attempt Shows Proxied Page Access

Alerts on OpenCanary HTTPPROXY events indicating a proxy request for another page.

OpenCanary: HTTP Form POST Login Attempt Observed on Port Service

Alerts on OpenCanary HTTP Form POST events indicating a login attempt to an exposed service.

OpenCanary application telemetry: HTTP GET requests received by monitored service

Alerts when OpenCanary logs an HTTP GET request to a monitored service endpoint.

OpenCanary Git Service: Git Clone Request Observed

Flags OpenCanary Git service logs showing a Git clone request, indicating possible repository access attempts.

OpenCanary FTP Login Attempt on Port 2000

Flags OpenCanary application events indicating an FTP login attempt on a monitored node.

GitHub Secret Scanning Disabled for Enterprise or Repository

Flags GitHub audit events that disable secret scanning for an enterprise or repository, reducing exposed secret detection.