deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Windows Webshell Strings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2017-02-19
ATT&CK techniques: T1505.003
Log source: /webserver

Description:
Detects common commands used in Windows webshells

Detection logic:
{
  "selection_method": {
    "cs-method": "GET"
  },
  "selection_keywords": [
    "=whoami",
    "=net%20user",
    "=net+user",
    "=net%2Buser",
    "=cmd%20/c%",
    "=cmd+/c+",
    "=cmd%2B/c%",
    "=cmd%20/r%",
    "=cmd+/r+",
    "=cmd%2B/r%",
    "=cmd%20/k%",
    "=cmd+/k+",
    "=cmd%2B/k%",
    "=powershell%",
    "=powershell+",
    "=tasklist%",
    "=tasklist+",
    "=wmic%",
    "=wmic+",
    "=ssh%",
    "=ssh+",
    "=python%",
    "=python+",
    "=python3%",
    "=python3+",
    "=ipconfig",
    "=wget%",
    "=wget+",
    "=curl%",
    "=curl+",
    "=certutil",
    "=copy%20%5C%5C",
    "=dsquery%",
    "=dsquery+",
    "=nltest%",
    "=nltest+"
  ],
  "condition": "all of selection_*"
}

References:
  - https://bad-jubies.github.io/RCE-NOW-WHAT/
  - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
Sigma Detection Rule: JNDIExploit Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-12
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt using the JNDI-Exploit-Kit

Detection logic:
{
  "keywords": [
    "/Basic/Command/Base64/",
    "/Basic/ReverseShell/",
    "/Basic/TomcatMemshell",
    "/Basic/JettyMemshell",
    "/Basic/WeblogicMemshell",
    "/Basic/JBossMemshell",
    "/Basic/WebsphereMemshell",
    "/Basic/SpringMemshell",
    "/Deserialization/URLDNS/",
    "/Deserialization/CommonsCollections1/Dnslog/",
    "/Deserialization/CommonsCollections2/Command/Base64/",
    "/Deserialization/CommonsBeanutils1/ReverseShell/",
    "/Deserialization/Jre8u20/TomcatMemshell",
    "/TomcatBypass/Dnslog/",
    "/TomcatBypass/Command/",
    "/TomcatBypass/ReverseShell/",
    "/TomcatBypass/TomcatMemshell",
    "/TomcatBypass/SpringMemshell",
    "/GroovyBypass/Command/",
    "/WebsphereBypass/Upload/"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/pimps/JNDI-Exploit-Kit
  - https://web.archive.org/web/[PII_REDACTED]5935/https://githubmemory.com/repo/FunctFan/JNDIExploit
Sigma Detection Rule: Cross Site Scripting Strings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Saw Win Naung, Nasreddine Bencherchali
Date: 2021-08-15
ATT&CK techniques: T1189
Log source: /webserver

Description:
Detects XSS attempts injected via GET requests in access logs

Detection logic:
{
  "select_method": {
    "cs-method": "GET"
  },
  "keywords": [
    "=<script>",
    "=%3Cscript%3E",
    "=%253Cscript%253E",
    "<iframe ",
    "%3Ciframe ",
    "<svg ",
    "%3Csvg ",
    "document.cookie",
    "document.domain",
    " onerror=",
    " onresize=",
    " onload=\"",
    "onmouseover=",
    "${alert",
    "javascript:alert",
    "javascript%3Aalert"
  ],
  "filter": {
    "sc-status": 404
  },
  "condition": "select_method and keywords and not filter"
}

References:
  - https://github.com/payloadbox/xss-payload-list
  - https://portswigger.net/web-security/cross-site-scripting/contexts
Sigma Detection Rule: Successful IIS Shortname Fuzzing Scan
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-10-06
ATT&CK techniques: T1190
Log source: /webserver

Description:
When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "~1",
    "cs-uri-query|endswith": "a.aspx",
    "cs-method": [
      "GET",
      "OPTIONS"
    ],
    "sc-status": [
      200,
      301
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml
  - https://www.exploit-db.com/exploits/19525
  - https://github.com/lijiejie/IIS_shortname_Scanner
Sigma Detection Rule: Suspicious Windows Strings In URI
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-06
ATT&CK techniques: T1505.003
Log source: /webserver

Description:
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "=C:/Users",
      "=C:/Program%20Files",
      "=C:/Windows",
      "=C%3A%5CUsers",
      "=C%3A%5CProgram%20Files",
      "=C%3A%5CWindows"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
Sigma Detection Rule: Webshell ReGeorg Detection Via Web Logs
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Cian Heasley
Date: 2020-08-04
ATT&CK techniques: T1505.003
Log source: /webserver

Description:
Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "cmd=read",
      "connect&target",
      "cmd=connect",
      "cmd=disconnect",
      "cmd=forward"
    ]
  },
  "filter": {
    "cs-referer": null,
    "cs-user-agent": null,
    "cs-method": "POST"
  },
  "condition": "selection and filter"
}

References:
  - https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3
  - https://github.com/sensepost/reGeorg
Sigma Detection Rule: Path Traversal Exploitation Attempts
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-09-25
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects path traversal exploitation attempts

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "../../../../../lib/password",
      "../../../../windows/",
      "../../../etc/",
      "..%252f..%252f..%252fetc%252f",
      "..%c0%af..%c0%af..%c0%afetc%c0%af",
      "%252e%252e%252fetc%252f"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/projectdiscovery/nuclei-templates
  - https://book.hacktricks.xyz/pentesting-web/file-inclusion
Sigma Detection Rule: Source Code Enumeration Detection by Keyword
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: James Ahearn
Date: 2019-06-08
ATT&CK techniques: T1083
Log source: /webserver

Description:
Detects source code enumeration that use GET requests by keyword searches in URL strings

Detection logic:
{
  "keywords": [
    ".git/"
  ],
  "condition": "keywords"
}

References:
  - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
  - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1
Sigma Detection Rule: Server Side Template Injection Strings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-14
ATT&CK techniques: T1221
Log source: /webserver

Description:
Detects SSTI attempts sent via GET requests in access logs

Detection logic:
{
  "select_method": {
    "cs-method": "GET"
  },
  "keywords": [
    "={{",
    "=%7B%7B",
    "=${",
    "=$%7B",
    "=<%=",
    "=%3C%25=",
    "=@(",
    "freemarker.template.utility.Execute",
    ".getClass().forName('javax.script.ScriptEngineManager')",
    "T(org.apache.commons.io.IOUtils)"
  ],
  "filter": {
    "sc-status": 404
  },
  "condition": "select_method and keywords and not filter"
}

References:
  - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
  - https://github.com/payloadbox/ssti-payloads
Sigma Detection Rule: OpenCanary - HTTP POST Login Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1190
Log source: opencanary/application

Description:
Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.


Detection logic:
{
  "selection": {
    "logtype": 3001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - FTP Login Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1190, T1021
Log source: opencanary/application

Description:
Detects instances where an FTP service on an OpenCanary node has had a login attempt.

Detection logic:
{
  "selection": {
    "logtype": 2000
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - SSH New Connection Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1133, T1021, T1078
Log source: opencanary/application

Description:
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Detection logic:
{
  "selection": {
    "logtype": 4000
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - SSH Login Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1133, T1021, T1078
Log source: opencanary/application

Description:
Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Detection logic:
{
  "selection": {
    "logtype": 4002
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - REDIS Action Command Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1003, T1213
Log source: opencanary/application

Description:
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

Detection logic:
{
  "selection": {
    "logtype": 17001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - SMB File Open Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1021, T1005
Log source: opencanary/application

Description:
Detects instances where an SMB service on an OpenCanary node has had a file open request.

Detection logic:
{
  "selection": {
    "logtype": 5000
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - RDP New Connection Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM)
Date: 2026-01-06
ATT&CK techniques: T1133, T1021.001
Log source: opencanary/application

Description:
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

Detection logic:
{
  "selection": {
    "logtype": 14001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - VNC Connection Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1021
Log source: opencanary/application

Description:
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

Detection logic:
{
  "selection": {
    "logtype": 12001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - NMAP OS Scan
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM)
Date: 2026-01-06
ATT&CK techniques: T1046
Log source: opencanary/application

Description:
Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan

Detection logic:
{
  "selection": {
    "logtype": 5002
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - MSSQL Login Attempt Via SQLAuth
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1003, T1213
Log source: opencanary/application

Description:
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.


Detection logic:
{
  "selection": {
    "logtype": 9001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - Telnet Login Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1133, T1078
Log source: opencanary/application

Description:
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Detection logic:
{
  "selection": {
    "logtype": 6001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - NTP Monlist Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1498
Log source: opencanary/application

Description:
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.

Detection logic:
{
  "selection": {
    "logtype": 11001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - HTTPPROXY Login Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1090
Log source: opencanary/application

Description:
Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.


Detection logic:
{
  "selection": {
    "logtype": 7001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - MySQL Login Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1003, T1213
Log source: opencanary/application

Description:
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.

Detection logic:
{
  "selection": {
    "logtype": 8001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - NMAP FIN Scan
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM)
Date: 2026-01-06
ATT&CK techniques: T1046
Log source: opencanary/application

Description:
Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan

Detection logic:
{
  "selection": {
    "logtype": 5005
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - NMAP XMAS Scan
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM)
Date: 2026-01-06
ATT&CK techniques: T1046
Log source: opencanary/application

Description:
Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan

Detection logic:
{
  "selection": {
    "logtype": 5004
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - TFTP Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1041
Log source: opencanary/application

Description:
Detects instances where a TFTP service on an OpenCanary node has had a request.

Detection logic:
{
  "selection": {
    "logtype": 10001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - NMAP NULL Scan
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM)
Date: 2026-01-06
ATT&CK techniques: T1046
Log source: opencanary/application

Description:
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan

Detection logic:
{
  "selection": {
    "logtype": 5003
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - SNMP OID Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1016, T1021
Log source: opencanary/application

Description:
Detects instances where an SNMP service on an OpenCanary node has had an OID request.

Detection logic:
{
  "selection": {
    "logtype": 13001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - MSSQL Login Attempt Via Windows Authentication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1003, T1213
Log source: opencanary/application

Description:
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.


Detection logic:
{
  "selection": {
    "logtype": 9002
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - GIT Clone Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1213
Log source: opencanary/application

Description:
Detects instances where a GIT service on an OpenCanary node has had Git Clone request.

Detection logic:
{
  "selection": {
    "logtype": 16001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - SIP Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1123
Log source: opencanary/application

Description:
Detects instances where an SIP service on an OpenCanary node has had a SIP request.

Detection logic:
{
  "selection": {
    "logtype": 15001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - HTTP GET Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Security Onion Solutions
Date: 2024-03-08
ATT&CK techniques: T1190
Log source: opencanary/application

Description:
Detects instances where an HTTP service on an OpenCanary node has received a GET request.

Detection logic:
{
  "selection": {
    "logtype": 3000
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: OpenCanary - Host Port Scan (SYN Scan)
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM)
Date: 2026-01-06
ATT&CK techniques: T1046
Log source: opencanary/application

Description:
Detects instances where an OpenCanary node has been targeted by a SYN port scan.

Detection logic:
{
  "selection": {
    "logtype": 5001
  },
  "condition": "selection"
}

References:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
Sigma Detection Rule: Python SQL Exceptions
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Thomas Patzke
Date: 2017-08-12
ATT&CK techniques: T1190
Log source: python/application

Description:
Generic rule for SQL exceptions in Python according to PEP 249

Detection logic:
{
  "keywords": [
    "DataError",
    "IntegrityError",
    "ProgrammingError",
    "OperationalError"
  ],
  "condition": "keywords"
}

References:
  - https://www.python.org/dev/peps/pep-0249/#exceptions