ARMS mutates detection rules for related attack technique variants
Original title: Automated Rule Mutation for Emerging Attack Variants using Infrastructure-Aware Technique Proximity
Authors say nearly all generated Sigma variants compiled to SIEM queries and about 92% still caught the original behavior.
Researchers present ARMS, an automated system that mutates detection rules when attackers change execution paths or telemetry while pursuing the same objective. It ranks related techniques in a three-dimensional proximity space covering structure, function, and environment, then uses Atomic Red Team commands in a retrieval-augmented generation pipeline. On public SigmaHQ rules, the authors report expanded coverage, working proximity dimensions, and infrastructure-aware customization.
Unconfirmed: Coverage and compile rates are the authors' evaluation results, not an independent assessment.
- Rules are grounded in verifiable Atomic Red Team execution commands.
- Proximity covers structural relations, functional similarity, and environmental constraints.
- About 92% of new rules detected the original behavior despite technique changes.
- Nearly all generated variant rules compiled into SIEM queries.
From the original article
1 min read at arxiv.orgDetection rules are typically crafted based on specific observations of an attack. While these rules are effective for particular attack instances, their coverage diminishes when adversaries modify their techniques, such as by employing alternative execution paths or adapting to different telemetry environments while achieving the same objective.
By Sepehr Ghaffarzadegan · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.