OpenCanary - SSH Login Attempt

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•29

Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.