Lion Cipher Lab
Write a Sigma correlation rule: catch a brute-force that SUCCEEDED (failed logins then a login)
- SOC Analyst / Blue Team
- Advanced
- ~70 min
- Free · no account required
Why it matters
A single-event rule can tell you 'a login failed' or 'a login succeeded.' Neither can tell you the thing a SOC actually cares about: that ONE user, on ONE host, failed to log in twenty times in ninety seconds and THEN got in. That is a brute-force that WON — an incident — and it is invisible to any rule that looks at one event at a time, because every individual event in the chain is boring on its own. The Sigma Correlations specification exists exactly for this: it lets you name simple base rules and then write a correlation that fires only when those base rules occur together, in a…
What you'll learn
- reading the Sigma Correlations spec (event_count, value_count, temporal, temporal_ordered)
- writing named base rules and referencing them from a correlation by name
- chaining an event_count threshold into a temporal_ordered sequence on one host
- validating with sigma check and seeing whether a backend can compile a correlation
- proving fire-on-attack / quiet-on-benign with a Python correlation evaluator
- judging timespan, clock-skew, and base-rate traps in multi-stage detection
Steps in this lab
- Why a single-event rule is blind to a brute-force that WON
- Set up the workspace and install the tooling
- Write the two BASE rules — and give each a name so it can be referenced
- Write the correlation: a threshold, then an ordered sequence
- Validate with 'sigma check', then try to convert it
- Build the proof: a tiny Python correlation evaluator
- Run the proof — fire on attack, quiet on benign, then feel the traps
- The judgment: when a correlation earns its complexity