AUTOSIGMA Turns Unstructured Threat Reports Into Sigma Detection Rules Without Trusting the LLM Alone

arXiv 2608.19011·medium signalXBlueskyLinkedInCopy link

Hand-writing Sigma rules is error-prone and does not scale with APT evolution, and public rule repositories lag emerging threats. AUTOSIGMA (arXiv 2608.19011, 2026-08-19) converts unstructured CTI reports into Sigma rules by enriching partial inputs against a structured knowledge base, grounding output against a repository of existing rules as templates, then iteratively validating with LLM-as-a-Judge, rather than generating from the model alone. Evaluated across multiple real-world APT reports and security blogs, it beats alternative solutions and raw LLMs on rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to poor input quality; a demo video is linked from the paper.