AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules that enables accurate, context-aware, and relevant rule generation, outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality.
Abstract
Mechanisms for dynamically converting cyber threat intelligence (CTI) into actionable detection capabilities are necessary due to the rapid evolution of Advanced Persistent Threats (APTs). Sigma rules are an essential part of contemporary threat detection workflows because they offer a platform-independent framework for expressing detection logic that can be converted into particular queries across SIEM systems. Conventional techniques for manually crafting Sigma rules are prone to mistakes, and necessitate extensive knowledge, which restricts their scalability. Although there are open-source and industry-maintained Sigma rule repositories, they often fail to keep pace with emerging threats and require frequent customization to fit diverse operational environments. This emphasizes the necessity of dynamic rule generation that is adapted to evolving attack techniques as well as particular use cases. In this work, we design AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules. Rather than relying solely on language models, AUTOSIGMA leverages a structured knowledge base to enrich partial inputs, matches the enriched content against a repository of existing Sigma rules, and then employs an LLM-as-a-Judge mechanism to iteratively validate the rules. By combining knowledge-driven enrichment, template-based rule grounding, and a multi-stage solution, AUTOSIGMA enables accurate, context-aware, and relevant rule generation. Evaluations across multiple real-world APT reports and multiple security blogs demonstrate that AUTOSIGMA outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality. AUTOSIGMA's Demo: https://youtu.be/iSr6IurQ6BM
The protocol documents a reproducible implementation for IOC-to-regex translation and explicitly delineates its current scope, operational assumptions, and known failure cases.
Peiyu Tseng, Peng Liu· Journal of Visualized Experi...· 0 citations
Cyber Threat Intelligence (CTI) enables Security Operations Centers (SOCs) to understand adversary behavior,
prioritize risks, and respond to cyber threats. However, cur-rent CTI workflows still depend heavily on manual analysis
of unstructured threat reports, vulnerability advisories, open-source intelligence, social media posts, and structured feeds. This
creates operational latency, inconsistent extraction quality, weak provenance, and limited scalability. This paper presents Auto
Threat AI, an agentic and explainable framework for automated CTI extraction, correlation, scoring, and analyst-governed SOC
operationalization. The proposed framework integrates determin-istic indicator extraction, Natural Language Processing (NLP),
schema-guided Large Language Model (LLM) agents, graph-aware threat correlation, bounded risk scoring, evidence-first
explainability, and Human-in-the-Loop (HITL) governance. The system ingests heterogeneous CTI sources, extracts entities and
relations such as IOCs, CVEs, malware, campaigns, threat actors, tools, and techniques, constructs a threat knowledge graph,
gen-erates campaign candidates, and presents risk-ranked intelligence through a SOC dashboard. Experimental evaluation on
safe demonstration CTI data shows that the implemented prototype ingested 6 sources, extracted 36 entities, generated 33
relations, detected 11 threat events, identified 5 campaign candidates, and routed 8 items for HITL review. The results
demonstrate that Auto Threat AI can reduce manual CTI processing effort while improving traceability, explainability, and
analyst trust.
Methari Keeravani· International Journal for Re...· 0 citations
Large Language Models (LLMs) are increasingly applied in cybersecurity, but most existing industry use cases focus on static, one-shot tasks such as classification, entity extraction, or summarization. While effective in narrow contexts, these applications fail to capture the complexity of real-world cybersecurity workflows, which often unfold over time, involve evolving inputs, and require multi-step reasoning. In this paper, we shift the focus toward dynamic cyber tasks—problems that demand context awareness, tool interaction, and adaptive decision-making. Our main goal is to define, analyze, and investigate the role of LLMs in automating these dynamic tasks. To achieve this, we introduce a characterization framework that profiles dynamic cyber tasks along four complementary dimensions: operational goal, knowledge grounding, collaboration mode, and cognitive complexity. We survey recent LLM-based systems across seven core domains: threat intelligence, data privacy and security, vulnerability detection, malware detection, intrusion detection, incident response and red teaming automation. Our analysis shows that current systems remain limited by privacy and deployment constraints, stale or incomplete threat knowledge, weak validation of feedback-driven actions, and insufficient evidence of operational benefit. We identify the need for privacy-aware deployment, timely retrieval and knowledge maintenance for emerging threats, process-level evaluation tied to measurable security outcomes, and human oversight within controlled and hybrid automation workflows. These findings clarify where LLMs can provide practical value and where conventional or hybrid approaches may remain more suitable.
Hanxin Yu, Shahrear Iqbal, Euclides Carlos Pinto et al.· International Journal of Inf...· 0 citations
This paper proposes an automated framework that extracts reachable attack chains by modeling each attack step as an attack unit of preconditions, an attack behavior, and postconditions, and produces attack units that are more complete and consistent than those generated by end-to-end LLM baselines.
Wenbo Hou, N. Hu, Xueping Wang et al.· 0 citations
While modern vehicle security depends on effective Cyber Threat Intelligence (CTI) synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an actionable, domain-specific knowledge base for automated attack graph generation. GARAGE synthesizes a dataset of 12,786 CVEs and 140 incident reports into a STIX 2.1 and Auto-ISAC ATM-compliant knowledge base. By formalizing tactical-pattern-level scenarios through granular kill chain analysis, GARAGE achieves threat generation capabilities. Our 320 Leave-One-Out experiments reveal that the framework can accurately transfer security knowledge to entirely unseen vehicle architectures. Furthermore, we position GARAGE as a scalable TARA support tool within human-in-the-loop workflows, offering a comprehensive cost-performance analysis to guide its deployment across various LLM tiers.
Daekwon Pi, Sangho Lee, Young Hun Lee et al.· 0 citations
The rapid integration of Large Language Models into autonomous agentic systems has introduced unprecedented capabilities for task automation, reasoning, and tool utilization. However, equipping these agents with the ability to access external APIs, internal databases, and arbitrary web resources significantly broadens the attack surface for data exfiltration. Malicious actors can leverage prompt injection and indirect prompt injection techniques to hijack the agent control flow, forcing it to retrieve sensitive information and transmit it to attacker-controlled destinations. Existing security mechanisms, which predominantly rely on static prompt filtering or heuristic anomaly detection, fail to maintain context across complex, multi-step tool invocations. This paper introduces a comprehensive framework based on Tool-Flow Taint Analysis designed to mitigate data exfiltration in Large Language Model agents. By adapting classical dynamic taint analysis principles to the semantic and operational workflows of agent toolchains, the proposed architecture tracks sensitive data from predefined sources through intermediate natural language reasoning steps to potential external sinks. We establish robust semantic taint propagation rules capable of operating within the non-deterministic environment of Large Language Models. Extensive experimental evaluations demonstrate that the proposed system achieves high efficacy in intercepting exfiltration attempts while maintaining a low false-positive rate and negligible latency overhead. The findings provide a critical foundation for securing next-generation autonomous agents against sophisticated data-stealing attacks in enterprise environments.
Chun Tian, Hiu-Tung Li, Michelle Yu· Journal of innovative resear...· 0 citations
