Search papers, labs, and topics across Lattice.
This paper introduces AUTOSIGMA, an automated system that transforms unstructured cyber threat intelligence (CTI) reports into actionable Sigma rules for threat detection. By integrating a structured knowledge base with a multi-stage approach that includes knowledge-driven enrichment and template-based rule grounding, AUTOSIGMA enhances the accuracy and relevance of generated rules. Evaluations reveal that AUTOSIGMA significantly outperforms existing solutions and LLM models in terms of rule validity, relevancy, and coverage of MITRE ATT&CK techniques.
AUTOSIGMA achieves superior rule generation by dynamically converting unstructured CTI into context-aware Sigma rules, outperforming traditional methods and LLMs.
Mechanisms for dynamically converting cyber threat intelligence (CTI) into actionable detection capabilities are necessary due to the rapid evolution of Advanced Persistent Threats (APTs). Sigma rules are an essential part of contemporary threat detection workflows because they offer a platform-independent framework for expressing detection logic that can be converted into particular queries across SIEM systems. Conventional techniques for manually crafting Sigma rules are prone to mistakes, and necessitate extensive knowledge, which restricts their scalability. Although there are open-source and industry-maintained Sigma rule repositories, they often fail to keep pace with emerging threats and require frequent customization to fit diverse operational environments. This emphasizes the necessity of dynamic rule generation that is adapted to evolving attack techniques as well as particular use cases. In this work, we design AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules. Rather than relying solely on language models, AUTOSIGMA leverages a structured knowledge base to enrich partial inputs, matches the enriched content against a repository of existing Sigma rules, and then employs an LLM-as-a-Judge mechanism to iteratively validate the rules. By combining knowledge-driven enrichment, template-based rule grounding, and a multi-stage solution, AUTOSIGMA enables accurate, context-aware, and relevant rule generation. Evaluations across multiple real-world APT reports and multiple security blogs demonstrate that AUTOSIGMA outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality. AUTOSIGMA's Demo: https://youtu.be/iSr6IurQ6BM
