I believe any "CAN" will be a "hit", not only in the last 3 bytes.
Yes, that would be true with SS.
When you do your testing, i'd suggest using at least one test record that has CAN embedded in the data as well as records with CAN at the end.
I thought of that and was going to suggest a more foolproof way to do it, but then it occurred to me looking at the data that CAN in uppercase would probably only appear as the last field. So I didn't bother.
If CAN can only appear at the end of the record, then these DFSORT control statements would work. I assumed the maximum record length is 80, but the INCLUDE statement can be changed appropriately for a different maximum record length.
If CAN can appear elsewhere, then tell me the maximum record length in the input file and I'll show you how to ensure that CAN is only found in the last three bytes.