Encore compiles public exploit proofs into threat-hunting rules
Original title: Set an Exploit to Catch an Exploit: Compiling Public Proofs of Concept into Threat Hunting Rules
Across 45 CVEs, Encore found 43 without reading logs and raised alerts on two wrong CVE pairs.
Researchers present Encore, which compiles a public Python proof-of-concept exploit into CVE-specific hunting rules over existing web-service logs without running the exploit. Of 45 evaluated CVEs, 37 eventually had a Sigma, Elastic, or Splunk rule, and the exploit arrived first for 33 by a median of 22 days. Encore found 43 of 45 CVEs without reading logs, compared with 30 covered by Splunk's log-tested rules. Its rules alerted on two wrong CVE pairs, versus 20 for Splunk's rules, and raised no alerts across 27,081 legitimate and crawl requests.
Unconfirmed: The paper does not name the 45 evaluated CVEs or report deployment outside the study.
- For 12 of 45 CVEs, rules captured the exploit's payload fragment or host operation.
- Encore found all 10 evaluated CVEs that lacked an ESCU rule.
- Most evaluation logs came from Splunk's public attack data recorded by a third party.
- The system maps library calls once per library to target-visible operations.
From the original article
1 min read at arxiv.orgPublic exploit code for a newly disclosed vulnerability usually appears before any published rule that detects its exploitation. Of the 45 CVEs we evaluate, 37 ever received a Sigma, Elastic or Splunk rule; in 33 the exploit came first, by a median of 22 days. Analysts still write every rule by hand.
By Muhammad Shoaib · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.