Detection rules are typically crafted from specific observations of an attack. They work well for particular instances, but their coverage diminishes when adversaries modify their techniques. A new arXiv paper (2610.24162) proposes automated rule mutation to address this gap.
The approach is based on "infrastructure-aware technique proximity," a concept that appears to guide how rules are mutated to cover emerging attack variants. The paper's abstract does not specify the exact mechanics, but the goal is to generate updated rules without manual intervention.
If effective, this could help security teams keep detection rules current as attacks evolve. The work is a preprint and has not been peer-reviewed.