OpenCanary - Telnet Login Attempt

calendar Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.command-and-control attack.t1133 attack.t1078  ·
Share on: linkedin copy

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Sigma rule (View on GitHub)

 1title: OpenCanary - Telnet Login Attempt
 2id: 512cff7a-683a-43ad-afe0-dd398e872f36
 3status: test
 4description: Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
 5references:
 6    - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
 7    - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
 8author: Security Onion Solutions
 9date: 2024-03-08
10tags:
11    - attack.privilege-escalation
12    - attack.persistence
13    - attack.defense-evasion
14    - attack.initial-access
15    - attack.command-and-control
16    - attack.t1133
17    - attack.t1078
18logsource:
19    category: application
20    product: opencanary
21detection:
22    selection:
23        logtype: 6001
24    condition: selection
25falsepositives:
26    - Unlikely
27level: high

References

Related rules

to-top