SIEM Correlation Rules for APT
FreeDetect advanced persistent threats with multi-event correlation.
Free · Opens the source repo
What SIEM Correlation Rules for APT does
This skill provides a framework for implementing multi-event correlation rules in SIEM systems, specifically targeting advanced persistent threats (APTs) by analyzing Windows event logs. It enables security teams to construct correlation searches that identify complex attack patterns, such as lateral movement and pass-the-hash attacks, which are often missed by single-event detections. By chaining together critical Windows authentication events, process executions, and network connections, users can create robust detection mechanisms that enhance their security posture.
The skill leverages the Splunk SPL and Sigma formats to define detection logic that correlates multiple event types across hosts. Users will find it particularly useful when configuring their SIEM systems to establish security controls aligned with compliance requirements or when conducting security assessments. The provided instructions guide users through the installation of necessary dependencies, connection to the Splunk REST API, and the creation of correlation searches that reflect multi-stage attack sequences.
With practical examples included, users can quickly adapt the provided Sigma rules and SPL queries to their specific environments. The skill supports the generation of correlation reports, allowing security teams to audit existing rules and identify coverage gaps effectively. This implementation is ideal for security professionals looking to strengthen their detection capabilities against sophisticated threats.
Overall, this skill is a valuable addition for organizations aiming to enhance their security operations and improve their ability to detect and respond to APT-related incidents.
When to use it
Use this skill when deploying SIEM correlation rules focused on detecting APTs, especially during security assessments or compliance checks.
When not to use it
This skill is not suitable for environments without a SIEM solution or for those not familiar with security operations concepts.
What you can build with it
Deploying SIEM Correlation Rules
Use this skill to establish effective SIEM correlation rules that detect APT lateral movement in your environment.
Conducting Security Assessments
Leverage this skill during security assessments to evaluate and improve your detection capabilities against multi-stage attacks.
Auditing Existing Detection Rules
Run the agent to generate correlation reports that help identify gaps in your existing detection rules.
How to install SIEM Correlation Rules for APT
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/implementing-siem-correlation-rules-for-apt --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Implementing SIEM Correlation Rules for APT
When to Use
- When deploying or configuring implementing siem correlation rules for apt capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
- Install dependencies:
pip install requests pyyaml sigma-cli - Connect to the Splunk REST API and define correlation searches that chain multiple event types across hosts.
- Build Sigma rules in YAML that express multi-step detection logic for lateral movement patterns:
- RDP logon (4624 LogonType=10) followed by service installation (7045) on same target within 15 minutes
- Pass-the-Hash: NTLM logon (4624 LogonType=3) followed by process creation (4688) of admin tools
- PsExec-style: Named pipe creation (Sysmon 17/18) correlated with remote service creation (7045)
- Convert Sigma rules to Splunk SPL using
sigma-cli convert. - Deploy correlation searches to Splunk ES via the REST API.
- Run the agent to generate and install correlation rules, then audit existing rules for coverage gaps.
python scripts/agent.py --splunk-url https://localhost:8089 --username admin --password changeme --output correlation_report.json
Examples
Detect RDP Lateral Movement Chain
index=wineventlog (EventCode=4624 Logon_Type=10) OR (EventCode=7045)
| transaction Computer maxspan=15m startswith=(EventCode=4624) endswith=(EventCode=7045)
| where eventcount >= 2
| table _time Computer Account_Name ServiceName
Sigma Rule for PsExec Lateral Movement
title: PsExec Lateral Movement Detection
logsource:
product: windows
service: sysmon
detection:
pipe_created:
EventID: 17
PipeName|startswith: '\PSEXESVC'
service_installed:
EventID: 7045
ServiceFileName|contains: 'PSEXESVC'
timeframe: 5m
condition: pipe_created | near service_installed
level: high
Frequently asked questions about SIEM Correlation Rules for APT
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.