Correlate

Rule catalog

Each rule is an independent, versioned module. It declares its scoring factors up front — Correlate reports the earned score against the maximum, never a verdict. A candidate becomes a relationship only when its earned score meets the acceptance threshold.

platphorm-default@1.0.013 rulesdigest sha256:f2ae9c855d24c…JSON →

Actor Host Activity

actor_host_activity

Relates consecutive endpoint actions by the same user on the same host into an activity timeline.

ruleactor-host-activity@1
window30m
accept ≥75 / 100
SameHostBoth actions occur on the same host
+30
SameUserBoth actions are attributed to the same user
+30
ConsecutiveThe two actions are temporally adjacent for that user on that host
+25
WithinWindowSecond action falls within the activity window
+15
requireshostuser

Authenticated Session

authenticated_session

Relates a user_logon to its matching user_logoff for the same user and host pair.

ruleauthenticated-session@1
window24h
accept ≥70 / 100
SameUserLogon and logoff share the same user
+30
SameHostPairLogon and logoff share the same source/dest host pair
+30
LogonBeforeLogoffA successful user_logon precedes a user_logoff
+25
WithinWindowLogoff occurs within the session window
+15
requiresuserhost

C2 Beacon

c2_beacon

Groups repeated outbound connections from an internal host to one external IP as beaconing.

rulec2-beacon@1
window6h
accept ≥55 / 100
RepeatedExternalContactThe same internal host contacts the same external IP more than once
+45
SameDestPortRepeated contacts use the same destination port
+20
RegularCadenceContacts recur at a roughly regular cadence (beaconing)
+25
NamedHostThe internal endpoint resolves to a named host
+10
requiresipv4

Cloud Exfiltration

cloud_exfiltration

Relates an external-bucket cloud upload to the staged archive it exfiltrates.

rulecloud-exfiltration@1
window12h
accept ≥50 / 100
ExternalBucketUpload destination bucket is owned by an external party
+35
UploadActionCloud action is an upload/share
+20
MatchesStagedArchiveUploaded file matches a previously staged archive by name and size
+30
LargeTransferTransferred volume is large
+15
requiresbucket

Credential Access

credential_access

Relates sensitive process access (e.g. LSASS) to a following file write on the same host.

rulecredential-access@1
window5m
accept ≥45 / 100
ProcessAccessA process_access observation targets a sensitive system process
+45
SameHostThe follow-on file is created on the same host
+20
FileWriteAfterA file_create follows the access within the window
+25
LargeArtifactThe written file is large enough to be a memory dump
+10
requireshostprocess

Data Staging

data_staging

Relates archive-tool execution to the archive artifact it stages on the same host.

ruledata-staging@1
window1h
accept ≥70 / 100
ArchiveToolA known archiving tool (7z/rar/zip/tar) is executed
+35
ArchiveArtifactAn archive file is created on the same host after the tool runs
+35
OutputPathMatchThe created archive matches the tool's output path/name
+20
LargeArtifactThe archive is large (bulk collection)
+10
requireshostfile

Egress Flow

egress_flow

Relates a source host to an external destination for outbound network connections.

rulehost-network-flow@1
window0s
accept ≥55 / 100
OutboundExternalConnection egresses from an internal host to an external destination
+40
AllowedFirewall action allowed the connection
+15
NamedSourceHostSource IP resolves to a named host
+25
SignificantVolumeBytes transferred exceed a nominal beacon threshold
+20
requireshostipv4

Indicator Removal

indicator_removal

Relates deletion of a file/service to its earlier creation on the same host.

ruleindicator-removal@1
window24h
accept ≥75 / 100
RemovesPriorArtifactDeletion targets a file or service that was created earlier on the same host
+55
SameHostCreation and removal occur on the same host
+25
AfterCreateRemoval happens after the creation
+20
requireshost

Lateral Movement

lateral_movement

Relates internal host-to-host admin-port connections to subsequent execution on the destination host.

rulelateral-movement@1
window6h
accept ≥70 / 100
InternalPairConnection is between two internal hosts
+25
NamedHostPairBoth source and destination resolve to named hosts
+25
AdminPortDestination port is a remote-admin/lateral port (445/3389/5985/22/135)
+30
FollowedByExecutionA process/service is created on the destination host shortly after
+20
requireshost

Process Egress

process_egress

Relates a process launch to a following outbound external connection from the same host.

ruleprocess-network@1
window1.5h
accept ≥70 / 100
SameHostThe network egress originates from the host where the process ran
+35
ProcessThenEgressAn outbound external connection follows a process launch on that host
+35
ExternalDestinationThe connection targets an external address
+20
InterpreterThe preceding process is a script interpreter/shell (common C2 launcher)
+10
requireshost

Process Lineage

process_lineage

Relates process_create events where child.parent_process matches a parent process_name on the same host.

ruleprocess-lineage@1
window15m
accept ≥60 / 100
SameHostBoth observations occur on the same host
+30
SameUserBoth observations share the same user
+20
DirectLineagechild.parent_process equals parent.process_name
+30
WithinWindowObservations fall inside the configured time window
+10
MonotonicTimechild starts at or after parent
+10
requireshostprocess

Remote Authentication

remote_authentication

Relates a network logon to the first endpoint activity by the same user on the destination host.

ruleremote-authentication@1
window1h
accept ≥70 / 100
NetworkLogonA successful network logon lands on the destination host
+35
ActivityOnDestEndpoint activity by the same user follows on the destination host
+35
SameUserThe logon and the follow-on activity share the same user
+20
ElevatedThe follow-on activity runs elevated
+10
requiresuserhost

Service Execution

service_execution

Relates a service creation to a child process spawned by that service on the same host.

ruleservice-execution@1
window10m
accept ≥70 / 100
ServiceCreateA service is created on the host
+30
ChildProcessFromServiceA process is spawned whose parent is the created service binary
+40
ElevatedThe spawned process runs at high/system integrity
+20
WithinWindowProcess spawns within the window of service creation
+10
requireshostservice