Automated Rule Mutation for Emerging Attack Variants using Infrastructure-Aware Technique Proximity

Abstract

Detection rules are typically crafted based on specific observations of an attack. While these rules are effective for particular attack instances, their coverage diminishes when adversaries modify their techniques, such as by employing alternative execution paths or adapting to different telemetry environments while achieving the same objective. To address this challenge, we introduce ARMS, an automated rule mutation solution that generates variant detection rules. ARMS defines a novel three-dimensional proximity space to identify techniques related to the original attack that capture structural relations, functional similarity, and environmental constraints. Rather than relying on ungrounded generation, ARMS leverages verifiable attack execution commands, which are extracted via semantic alignment with the Atomic Red Team repository, to construct a context-aware Retrieval-Augmented Generation (RAG) pipeline. We evaluated ARMS using verified, public SigmaHQ rules and successfully generated variants, demonstrating ARMS's capability to expand detection coverage. We further evaluated ARMS across multiple research questions, showing the effectiveness of each proximity dimension and infrastructure-aware rule customization. Nearly all generated variant rules successfully compiled into SIEM queries, and ~92% of the newly generated rules detect the original behavior despite attackers' technique variations.