log-correlation-patterns

Log Correlation Patterns

Patterns for correlating events across multiple log sources to detect multi-stage attacks, lateral movement, credential abuse, and data exfiltration.

Knowledge Base

Why Correlation Matters

Single-event detections catch simple attacks. Advanced threats operate across multiple stages, systems, and time windows. Correlation combines events from different sources to detect attack patterns that no single log source reveals on its own.

Example: A brute-force attack (authentication log) followed by successful login (authentication log) followed by new scheduled task (Sysmon) followed by outbound connection to rare domain (DNS log) tells a complete attack story that individual alerts would only partially reveal.

Correlation Techniques

Time-based correlation: Events from different sources within a time window

Event A (authentication failure x5 in 60 seconds)
  -> Event B (successful authentication within 120 seconds)
  -> Event C (privilege escalation within 300 seconds)

Entity-based correlation: Events linked by a common entity (user, host, IP)

Same user account:
  - Authenticated from Location A at T1
  - Authenticated from Location B at T1+30min (impossible travel)

Sequence-based correlation: Events that must occur in a specific order

Step 1: Process creates file in temp directory
Step 2: Same process modifies registry run key pointing to that file
Step 3: Outbound network connection from that process

Statistical correlation: Deviations from baseline behavior

User normally accesses 5 file shares -> Suddenly accesses 50
Host normally sends 100MB outbound -> Sends 10GB in one hour

Common Correlation Patterns

Pattern 1: Brute Force to Compromise

Correlate authentication failures with subsequent success from the same source.

Sigma-like logic:
  Source: Authentication logs
  Step 1: count(failed_login) > 5 WHERE source_ip = X AND timewindow = 5m
  Step 2: successful_login WHERE source_ip = X AND timewindow = 10m after Step 1
  Severity: High