Write multi-event correlation rules in Splunk SPL and Sigma format that detect APT lateral movement by chaining Windows authentication events (4624, 4648), process execution (4688, Sysmon Event 1), and network connections (Sysmon Event 3) across hosts within sliding time windows.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-siem-correlation-rules-for-aptnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-siem-correlation-rules-for-apt -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-siem-correlation-rules-for-apt -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/implementing-siem-correlation-rules-for-aptgh skill install mukul975/Anthropic-Cybersecurity-Skills implementing-siem-correlation-rules-for-aptgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/implementing-siem-correlation-rules-for-apt ~/.claude/skills/implementing-siem-correlation-rules-for-apt # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/implementing-siem-correlation-rules-for-apt ~/.agents/skills/implementing-siem-correlation-rules-for-apt # Codex, Cursor, Gemini CLI, Copilot, OpenCode