Turning threat reports into detections

Threat reports contain useful evidence, but analysts must translate that evidence into searches and detection logic. My work explores LLM agents that extract indicators from reports and correlate them with enterprise logs.

In IOCRegex-gen, our research turns indicators into regular expressions using group-aware generation, iterative reasoning, and multiple validation stages. The aim is to capture meaningful variations without treating every indicator as an exact string.

The 2026 preprint reports evaluation on more than 3,000 CTI reports and 2,400 ground-truth strings from MITRE ATT&CK Evaluations. Its reported 99.1% average hit rate and 0.8% false-positive rate apply to that evaluation; they are not claims about production detection performance.

Research approach

1. Extract indicators from unstructured CTI.
2. Generate context-sensitive detection patterns.
3. Validate syntax and matching behavior against evaluation data.