OpenCanary - MySQL Login Attempt

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•1•0•26

Detects instances where a MySQL service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to gain unauthorized access to the honeypot's emulated MySQL service, which can be a sign of reconnaissance or credential stuffing activities.