OpenCanary Telnet Login Attempt

OpenCanary is a low-interaction honeypot designed to detect attackers on a network. This detection focuses on Telnet login attempts, a protocol rarely used legitimately in modern networks and thus a strong indicator of malicious activity. When an attacker attempts to log into a Telnet service on an OpenCanary node, it triggers this alert. This provides early warning of potential intrusion attempts, reconnaissance activities, or lateral movement by attackers who have already gained a foothold. The detection is based on OpenCanary’s logging functionality which records such login attempts, generating a log event with code 6001. This event signifies an attacker interacting with the Telnet service, which is unlikely in a well-secured and properly configured environment.

Attack Chain

1. Attacker scans the network for open ports, identifying a Telnet service.
2. Attacker attempts to connect to the Telnet service on the OpenCanary node.
3. Attacker enters credentials (username and password) in an attempt to authenticate.
4. OpenCanary logs the Telnet login attempt, generating an event with logtype 6001.
5. The detection rule triggers based on the OpenCanary log event.
6. Security team investigates the alert to determine the source and intent of the Telnet login attempt.
7. If the attempt is malicious, the security team takes steps to block the attacker and prevent further access.

Impact

A successful Telnet login could provide an attacker with unauthorized access to the network or specific systems. While Telnet itself may not grant immediate access to sensitive data, it can be used as a stepping stone for further exploitation and lateral movement. The compromise of even a single system can lead to data breaches, ransomware deployment, and significant disruption of services. OpenCanary serves as an early warning system, allowing defenders to identify and respond to such attempts before significant damage occurs.

Recommendation

• Deploy the Sigma rule OpenCanary - Telnet Login Attempt to your SIEM to detect unauthorized Telnet login attempts.
• Investigate any alerts generated by the OpenCanary - Telnet Login Attempt rule to determine the source and intent of the connection.
• Review the OpenCanary configuration to ensure it is properly deployed and monitoring the appropriate network segments.
• Consider disabling the Telnet service on all legitimate systems on the network to reduce the attack surface.