You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks

TL;DR

This paper introduces AMIDES, an adaptive misuse detection system that uses machine learning to identify evasions of SIEM rules in enterprise networks, significantly improving detection of malicious activities.

Contribution

The paper presents AMIDES, a novel open-source system that detects SIEM rule evasions using machine learning, addressing critical blind spots in existing security monitoring.

Findings

AMIDES detects most evasions with no false alerts.

It reduces detection blind spots in enterprise networks.

AMIDES is computationally efficient for real-world deployment.

Abstract

Cyberattacks have grown into a major risk for organizations, with common consequences being data theft, sabotage, and extortion. Since preventive measures do not suffice to repel attacks, timely detection of successful intruders is crucial to stop them from reaching their final goals. For this purpose, many organizations utilize Security Information and Event Management (SIEM) systems to centrally collect security-related events and scan them for attack indicators using expert-written detection rules. However, as we show by analyzing a set of widespread SIEM detection rules, adversaries can evade almost half of them easily, allowing them to perform common malicious actions within an enterprise network without being detected. To remedy these critical detection blind spots, we propose the idea of adaptive misuse detection, which utilizes machine learning to compare incoming events to SIEM rules on the one hand and known-benign events on the other hand to discover successful evasions. Based on this idea, we present AMIDES, an open-source proof-of-concept adaptive misuse detection system. Using four weeks of SIEM events from a large enterprise network and more than 500 hand-crafted evasions, we show that AMIDES successfully detects a majority of these evasions without any false alerts. In addition, AMIDES eases alert analysis by assessing which rules were evaded. Its computational efficiency qualifies AMIDES for real-world operation and hence enables organizations to significantly reduce detection blind spots with moderate effort.