Detectionhightest

OpenCanary - SNMP OID Request

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Security Onion SolutionsCreated Fri Mar 08e9856028-fd4e-46e6-b3d1-10f7ceb95078application

Log Source

opencanaryapplication

Productopencanary← raw: opencanary

Categoryapplication← raw: application

Detection Logic

detection:
    selection:
        logtype: 13001
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

e9856028-fd4e-46e6-b3d1-10f7ceb95078

Status

test

Level

high

Type

Detection

Created

Fri Mar 08

Author

Path

rules/application/opencanary/opencanary_snmp_cmd.yml

Raw Tags

attack.discoveryattack.lateral-movementattack.t1016attack.t1021