Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Implementing SIEM Correlation Rules for APT · mukul975 | DecimalAI

Implementing Siem Correlation Rules For Apt

SkillScore45Maintained

implementing-siem-correlation-rules-for-apt

Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to surface attack sequences invisible to single-event detections.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-siem-correlation-rules-for-apt/SKILL.md

decimalai skills pull implementing-siem-correlation-rules-for-apt --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-siem-correlation-rules-for-apt/SKILL.md https://app.decimal.ai/s/implementing-siem-correlation-rules-for-apt/SKILL.md

Raw file: /s/implementing-siem-correlation-rules-for-apt/SKILL.md ↗ · machine-readable summary at /s/implementing-siem-correlation-rules-for-apt.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +32% lift-6% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-10	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—
case-15	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-siem-correlation-rules-for-apt/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Implementing SIEM Correlation Rules for APT

When to Use

When deploying or configuring implementing siem correlation rules for apt capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests pyyaml sigma-cli
Connect to the Splunk REST API and define correlation searches that chain multiple event types across hosts.
Build Sigma rules in YAML that express multi-step detection logic for lateral movement patterns:

RDP logon (4624 LogonType=10) followed by service installation (7045) on same target within 15 minutes
Pass-the-Hash: NTLM logon (4624 LogonType=3) followed by process creation (4688) of admin tools
PsExec-style: Named pipe creation (Sysmon 17/18) correlated with remote service creation (7045)

Convert Sigma rules to Splunk SPL using sigma-cli convert.
Deploy correlation searches to Splunk ES via the REST API.
Run the agent to generate and install correlation rules, then audit existing rules for coverage gaps.

bash
python scripts/agent.py --splunk-url https://localhost:8089 --username admin --password changeme --output correlation_report.json

Examples

Detect RDP Lateral Movement Chain

index=wineventlog (EventCode=4624 Logon_Type=10) OR (EventCode=7045)
| transaction Computer maxspan=15m startswith=(EventCode=4624) endswith=(EventCode=7045)
| where eventcount >= 2
| table _time Computer Account_Name ServiceName

Sigma Rule for PsExec Lateral Movement

yaml
title: PsExec Lateral Movement Detection
logsource:
  product: windows
  service: sysmon
detection:
  pipe_created:
    EventID: 17
    PipeName|startswith: '\PSEXESVC'
  service_installed:
    EventID: 7045
    ServiceFileName|contains: 'PSEXESVC'
  timeframe: 5m
  condition: pipe_created | near service_installed
level: high

Illustrative Want to see what implementing-siem-correlation-rules-for-apt would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 09:58 UTC · 22 cases

Lift

+32%

45% vs 14%

Agent turns

1.0 vs 1.0

Tokens

-6%

1,947.05 vs 2,075.59

fail → pass · 7pass → pass · 3fail → fail · 12

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-21 Can you help me write a YARA rule with hex patterns to scan local disk binaries for packed Cobalt Strike beacons?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 What event log ID and service filename substring indicate the service installation step of PsExec execution on a target host?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We are setting up an environment to write, convert, and push APT detection rules to Splunk. Which Python libraries and CLI tool package must be installed via pip?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 I am tasked with creating SIEM correlation searches that detect chained lateral movement patterns across Windows endpoints, such as remote logons followed quickly by service creation. What is the standard procedure to write these multi-step detection rules, translate them to SPL, and generate an automated coverage report?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 In Splunk SPL, when correlating an RDP logon event with a service installation on the same host to catch lateral movement, what maximum time window threshold should be set for the transaction?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 In a Sigma rule YAML definition monitoring named pipe creation, what product and service values must be specified in the logsource block?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 How do I deploy and configure the CrowdStrike Falcon Sensor binary on a Windows Server host using PowerShell?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Our SOC is upgrading its security controls against advanced persistent threats by writing YAML-based Sigma rules and deploying them to Splunk Enterprise Security. Can you guide me through the setup, conversion process, and execution of the python script to audit our rule coverage?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 How should newly translated SPL correlation searches be delivered into Splunk Enterprise Security from an automated deployment script?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 What specific event logs and criteria should be correlated in a Windows environment to detect Pass-the-Hash activity targeting administrative tools?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 When detecting PsExec-style lateral movement via Sysmon and Windows system logs, which Sysmon event IDs and field criteria identify named pipe creation?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 What minimum Python runtime version requirement must be satisfied before executing the SIEM rule deployment agent script?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 In the SPL query correlating remote logon and service creation, what threshold condition on event count ensures only host events containing both steps are returned?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 In a Splunk SPL query that groups RDP logon events and service creation events into a single correlation transaction across host records, which field should be used to unify events on the same target host?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 When converting YAML correlation rules into Splunk Search Processing Language for deployment to Splunk Enterprise Security, should the target format flag be set to splunk_syslog or splunk?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We need to establish multi-stage detection logic in our SIEM to catch lateral movement techniques used by APT groups. Could you walk me through the full workflow for authoring vendor-neutral rules, converting them into Splunk query language, and pushing them into our SIEM via the API?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When authoring a Windows correlation rule to detect RDP-based lateral movement followed by service installation on the target host within a short window, which specific Windows Event IDs and logon type must be combined?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 In a YAML Sigma rule designed for PsExec detection combining pipe creation and service installation, what timeframe value and condition expression pattern should be defined?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Which command-line interface tool and subcommand should be invoked to translate vendor-neutral YAML Sigma rules into Splunk Search Processing Language?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What specific fields should be selected in the final table output of the SPL transaction search for RDP lateral movement?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When constructing a SIEM correlation search for Pass-the-Hash, which Windows Security log Event ID tracks the process execution of administrative utility programs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 What commands are needed to configure BGP routing and IPsec VPN tunnels on a Cisco ASA firewall to establish secure site-to-site connectivity?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +32 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13.6%
Pass rate with the skill: 45.5%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 09:58 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run45

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-47% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.