implementing-siem-correlation-rules-for-apt

Write multi-event correlation rules that detect APT lateral movement