Detectionhightest

OpenCanary - SSH Login Attempt

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Security Onion SolutionsCreated Fri Mar 08ff7139bc-fdb1-4437-92f2-6afefe8884cbapplication

Log Source

opencanaryapplication

Productopencanary← raw: opencanary

Categoryapplication← raw: application

Detection Logic

detection:
    selection:
        logtype: 4002
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

ff7139bc-fdb1-4437-92f2-6afefe8884cb

Status

test

Level

high

Type

Detection

Created

Fri Mar 08

Author

Path

rules/application/opencanary/opencanary_ssh_login_attempt.yml

Raw Tags

attack.privilege-escalationattack.defense-evasionattack.initial-accessattack.lateral-movementattack.persistenceattack.t1133attack.t1021attack.t1078