From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation
This paper introduces AUTOSIGMA, an automated framework that transforms unstructured cyber threat intelligence into actionable Sigma rules by combining knowledge-driven enrichment, template-based grounding, and LLM-based validation to overcome the scalability and accuracy limitations of manual rule creation.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the high-stakes world of cybersecurity, defenders often find themselves reacting to attacks long after they have begun. The information about these attacks usually arrives in the form of detailed reports written by intelligence experts. These documents describe how sophisticated criminal groups, known as Advanced Persistent Threats, sneak into networks, move around, and steal data. However, these reports are written in plain language, full of narrative details and human context, which makes them difficult for computers to read and act upon immediately. To stop an attack in real time, security systems need specific instructions called detection rules. These rules act like precise filters, scanning millions of digital events to find the exact patterns of a specific threat. Creating these rules by hand is a slow, error-prone process that requires deep expertise, and by the time a human analyst finishes writing a rule for a new threat, the attackers may have already changed their methods.
The core challenge lies in bridging the gap between a human-written story about an attack and the rigid, technical code a computer needs to hunt it down. Security teams need a way to automatically translate these unstructured narratives into actionable detection logic without losing the nuance that makes the threat real. If this translation can be automated, organizations could deploy defenses the moment a new threat is discovered, rather than waiting days or weeks for manual analysis. This is the problem a team of researchers set out to solve by developing a new system designed to read threat reports and instantly generate the necessary digital safeguards.
The researchers created a system called AUTOSIGMA, which acts as an automated translator between human intelligence and machine defense. Instead of simply asking a computer to guess the rules based on a text description, the system follows a careful, multi-step process that mimics how a human expert would think, but with the speed of a machine. First, the system reads the raw threat report and breaks it down, identifying the key players, the tools used, and the specific steps the attackers took. It then goes a step further by consulting vast external databases of known vulnerabilities and attack techniques to fill in any missing details. If a report mentions a specific software flaw but doesn't explain how it works, the system looks up that flaw in a global database to understand its behavior fully. This ensures that the system has a complete picture of the attack, even if the original report was vague or incomplete.
Once the system understands the full scope of the attack, it breaks the complex scenario down into small, individual steps. A single attack might involve dozens of actions, and trying to catch them all in one rule would be ineffective. By separating the attack into atomic parts, the system can create a specific rule for each step, making the detection much more precise. The next phase is where the system draws on the collective experience of the security community. It searches through a massive, constantly updated library of existing detection rules to find ones that are similar to the steps it just identified. Think of this as a master builder looking at a library of proven blueprints before constructing a new house; the system uses these existing, vetted patterns as a foundation. This prevents the system from inventing rules from scratch that might be flawed or miss the mark, ensuring that the new rules are grounded in logic that has already been tested by experts.
With a solid foundation and a clear understanding of the threat, the system then generates the actual detection rule. However, it does not stop there. The researchers designed a unique checking mechanism where two artificial intelligence models work together in a loop. One model acts as the creator, writing the rule based on the threat details and the chosen blueprint. The second model acts as a strict judge, reviewing the rule to see if it makes sense, if it follows the correct technical format, and if it will actually catch the threat without causing false alarms. If the judge finds a mistake, it sends the rule back to the creator with specific feedback on how to fix it. This cycle repeats until the rule is perfect. This back-and-forth process is crucial because it catches errors that a single model might miss, such as a missing detail or a logical gap, ensuring the final output is reliable enough to be used in real-world security systems.
The researchers tested this system using real-world reports from some of the most notorious cybercriminal groups in history, including APT41, APT28, and APT29. They compared the rules generated by AUTOSIGMA against those produced by other automated tools and against the outputs of advanced language models used on their own. The results showed that their system was significantly better at producing rules that were both technically correct and relevant to the specific threats described. It managed to cover more of the known attack techniques and was more robust when dealing with reports that were poorly formatted or lacked detail. The study suggests that by combining external knowledge, existing rule templates, and a rigorous self-checking process, it is possible to automate the creation of high-quality detection rules. This approach does not just speed up the process; it improves the quality of the defense, allowing security teams to respond to evolving threats with a level of precision and speed that manual methods cannot match.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.