Exploit code helps create faster rules to catch cyberattacks
Set an Exploit to Catch an Exploit: Compiling Public Proofs of Concept into Threat Hunting Rules
Cryptography and Security
Summary
When new software vulnerabilities are found, hackers often share code to exploit them before security teams develop ways to detect the attacks. The authors created Encore, a tool that turns publicly available exploit code into rules that detect attacks in web server logs, without running the exploit itself. Encore uses a special method to match the exploit code's behavior to what shows up in the logs, making detection faster and more accurate. This helps security teams start hunting for attacks as soon as exploit code is published, improving defense timing.
What this means in practice
- •For cybersecurity analysts: Automatically create detection rules from public exploit code to identify attacks faster in web logs.
- •For security operations teams: Start threat hunting immediately after a vulnerability appears by using exploit-based rules to spot real attack payloads in logs.
- •For intrusion detection vendors: Develop products that generate detection rules quickly from exploit code to reduce false alarms and improve coverage.$Commercial implications: Enables rule automation products that integrate public exploits to enhance attack detection for customers.
Authors
Muhammad Shoaib, Alexander Suh, Joshua Andrew Tomiak, Wajih Ul Hassan
Abstract
Public exploit code for a newly disclosed vulnerability usually appears before any published rule that detects its exploitation. Of the 45 CVEs we evaluate, 37 ever received a Sigma, Elastic or Splunk rule; in 33 the exploit came first, by a median of 22 days. Analysts still write every rule by hand. We present Encore, which compiles a public Python proof-of-concept exploit (PoC) into CVE-specific hunting rules over a web service's existing logs, without running it. Encore rests on the PoC Behavior Alignment Principle: a PoC performs the exploit, so its code already provides a rule's HTTP requests, payloads and host operations. That is hard to act on: a PoC is written against libraries and runs on the attacker's machine, while the target's web-server, proxy and host logs record only what arrived and what it did. Encore closes the gap with a map from library calls to the operations they cause, built once per library, keeping only the operations visible on the target. For 12 of the 45, Encore's rule states the exploit's own payload fragment or host operation, which is evidence of the exploit itself, and not of traffic to its endpoint. On matched controls it separates that exploit from the same request with a harmless value, and it raises no alerts across 27,081 legitimate and crawl requests. We never compile the exploit that produced the logs. Most are Splunk's public attack data, recorded by a third party. Without reading a single log, Encore's rules find 43 of the 45. Splunk's log-tested rules cover 30 of the 45, and Encore finds 28 of those, plus all 10 CVEs without an ESCU rule. Where Splunk's rules alert on 20 wrong CVE pairs, Encore's alert on only 2. Hunting can start as soon as a PoC is public, and rules can raise an alert when it provides a payload or host operation.