Skip to content

IoC

From IOCs to Regex: Automating CTI Operationalization for SOC with LLMs

https://arxiv.org/abs/2604.12228

  • CTI reports describe attacker behaviors and provide IOCs such as file paths, registry keys, and command-line arguments.
  • There is a fundamental gap between how attacker behaviors are described in CTI reports and how they are recorded in specific system logs. For example, a CTI report may describe an attacker creating a scheduled task with the command schtasks.exe \create \tn …, but in system logs, the same activity may appear with different path delimiters, execution parameters, or capitalization, making exact string matching infeasible.

  • Even if IOCs are successfully extracted from CTI reports, threat intelligence remains difficult to operationalize in practice.

  • The de facto strategy to bridge this gap is the use of regexes. In practice, human analysts manually translate IOCs extracted from CTI reports into regexes, which can then be executed by computers to search massive log data.

  • We analyzed 1,735 public Splunk detection rules and found that over 64% contained regex patterns related to file paths, registry keys, or command-line arguments.

  • According to the Pyramid of Pain the low-value indicators—such as hash values, IP addresses, domain names, and network artifacts—are the ones most easily changed by adversaries and are thus highly volatile.

  • In contrast, file paths, registry keys, and command-line arguments reliably reveal persistent threats. They inherently contain both fixed and variable components—such as stable system directories combined with attacker-controlled filenames or parameters
  • In SOC operations, regex is commonly used because IOCs from CTI reports cannot be directly matched with system logs for two key reasons.
  • Each machine’s system context is unique. Even if the attacker uses the same command line argument, the actual implementation may vary slightly across different environments. For example, when an attacker uses a certain command to create a scheduled task, they might change the path of the invoked program depending on the machine’s system context, or adjust the execution time based on the machine’s timezone.
  • Even slight differences in capitalization, path delimiters, or whitespace will often cause missed detections. If pattern matching relied solely on literal strings, variations like temp1.exe, temp2.exe, tmpA34.dll would evade detection due to their minor naming differences.
  • Using regex, however, allows these payloads to be matched collectively by identifying shared elements like filename prefixes and extensions. Therefore, after obtaining IOCs, security analysts construct regexes to efficiently identify string variations that are similar to, but not exactly the same as, the original IOCs