skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-siem-correlation-rules-for-apt

Write multi-event SIEM correlation rules detecting APT lateral movement across Windows logs.

954|172|Updated Mar 13, 2026
Search Tags:#lateral movement#security operations#siem#splunk#sigma#correlation rules#apt detection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-siem-correlation-rules-for-apt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-siem-correlation-rules-for-apt
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/security-operations/implementing-siem-correlation-rules-for-apt
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-siem-correlation-rules-for-apt

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, pyyaml, sigma-cli, and includes scripts (resource) components.

What problem does it solve?

Single-event detections miss multi-stage APT attacks like lateral movement, where each individual event looks benign. This Skill chains Windows authentication events, process execution telemetry, and network connection logs into correlation rules that surface attack sequences invisible to isolated alerts.

Core Features & Use Cases

  • Multi-Event Correlation: Chain Event IDs 4624, 4648, 4688, 7045, and Sysmon Events 1/3/17/18 within sliding time windows to detect RDP lateral movement, Pass-the-Hash, and PsExec-style attacks.
  • Sigma and Splunk SPL Support: Author detection logic in portable Sigma YAML format and convert it to Splunk SPL using sigma-cli for deployment.
  • Splunk ES Deployment: Push correlation searches to Splunk Enterprise Security via the REST API and audit existing rules for coverage gaps.
  • Use Case: A SOC analyst suspects lateral movement after an initial compromise. Use this Skill to build a rule correlating an RDP logon (4624 LogonType=10) with a service installation (7045) on the same host within 15 minutes, then deploy it to Splunk ES.

Quick Start

Ask the agent to generate and install Sigma-based correlation rules for detecting PsExec and RDP lateral movement in your Splunk environment, then produce a coverage audit report.

Frequently Asked Questions about implementing-siem-correlation-rules-for-apt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect lateral movement with SIEM correlation rules?▼

Correlate multiple Windows events within a time window, such as an RDP logon (Event 4624 LogonType=10) followed by service installation (Event 7045) on the same host within 15 minutes. Express this logic in Sigma YAML or Splunk SPL transaction queries.

How to convert Sigma rules to Splunk SPL queries?▼

Use the sigma-cli tool with the convert command to translate Sigma YAML rules into Splunk SPL. Install it via pip, then run sigma-cli convert with the appropriate Splunk backend target before deploying to Splunk ES.

What Windows Event IDs indicate Pass-the-Hash attacks?▼

Pass-the-Hash typically appears as NTLM network logons (Event 4624 LogonType=3) followed by process creation (Event 4688) of administrative tools. Correlating these events on the same host within a short window surfaces the attack pattern.

Can Sigma rules detect PsExec lateral movement?▼

Yes, PsExec detection correlates Sysmon named pipe creation (Event 17 with PSEXESVC pipe name) with service installation (Event 7045) using a near condition within a 5-minute timeframe. The rule uses Sysmon and Windows service log sources.

Why do single-event detections miss APT attacks?▼

Individual events like logons or service installations appear benign in isolation and generate excessive false positives. APT attacks unfold as multi-step sequences, so only correlation across events, hosts, and time windows reveals the malicious pattern.

Related Skills

Explore More Software Engineering Skills→
chambear2809chambear2809
36

splunk-sysmon-ta-setup

Automate setup and validation of the Splunk Add-on for Microsoft Sysmon.

Community
Advanced
elasticelastic
546

security-case-management

Create, search, update, and attach alerts to SOC cases via the Kibana Cases API.

Official
Intermediate
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced
refractionPOINTrefractionPOINT
29

test-limacharlie-adapter

Deploy a temporary LimaCharlie Adapter on Linux or macOS for testing log ingestion.

Official
Advanced