# You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks

arXiv: https://arxiv.org/abs/2311.10197 · HTML: https://mlsanity.com/paper/2311.10197/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Nov 2023.

## Built on by (most cited first, 6 of 6)

- [Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence](https://mlsanity.com/paper/2509.23573/) (2025)
- [RulePilot: An LLM-Powered Agent for Security Rule Generation](https://mlsanity.com/paper/2511.12224/) (2025)
- [POLAR: Automating Cyber Threat Prioritization through LLM-Powered Assessment](https://mlsanity.com/paper/2510.01552/) (2025)
- [Democratizing ML for Enterprise Security: A Self-Sustained Attack Detection Framework](https://mlsanity.com/paper/2512.08802/) (2025)
- [ARuleCon: Agentic Security Rule Conversion](https://mlsanity.com/paper/2604.06762/) (2026)
- [FORGE: Multi-Agent Graduated Exploitation and Detection Engineering](https://mlsanity.com/paper/2606.03453/) (2026)

## Abstract (arXiv)

Cyberattacks have grown into a major risk for organizations, with common consequences being data theft, sabotage, and extortion. Since preventive measures do not suffice to repel attacks, timely detection of successful intruders is crucial to stop them from reaching their final goals. For this purpose, many organizations utilize Security Information and Event Management (SIEM) systems to centrally collect security-related events and scan them for attack indicators using expert-written detection rules. However, as we show by analyzing a set of widespread SIEM detection rules, adversaries can evade almost half of them easily, allowing them to perform common malicious actions within an enterprise network without being detected. To remedy these critical detection blind spots, we propose the idea of adaptive misuse detection, which utilizes machine learning to compare incoming events to SIEM rules on the one hand and known-benign events on the other hand to discover successful evasions. Based on this idea, we present AMIDES, an open-source proof-of-concept adaptive misuse detection system. Using four weeks of SIEM events from a large enterprise network and more than 500 hand-crafted evasions, we show that AMIDES successfully detects a majority of these evasions without any false alerts. In addition, AMIDES eases alert analysis by assessing which rules were evaded. Its computational efficiency qualifies AMIDES for real-world operation and hence enables organizations to significantly reduce detection blind spots with moderate effort.