# Arxiv Research Paper: "You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks"

**URL:** https://community.limacharlie.com/t/arxiv-research-paper-you-cannot-escape-me-detecting-evasions-of-siem-rules-in-enterprise-networks/166
**Category:** Community Intel
**Created:** [March 18, 2025, 4:04am UTC](https://community.limacharlie.com/t/arxiv-research-paper-you-cannot-escape-me-detecting-evasions-of-siem-rules-in-enterprise-networks/166 "2025-03-18T04:04:53Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Signalblur](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/signalblur/32/11_2.png) [@Signalblur](https://community.limacharlie.com/u/Signalblur)
#### Post date: [March 18, 2025, 4:04am UTC](https://community.limacharlie.com/t/arxiv-research-paper-you-cannot-escape-me-detecting-evasions-of-siem-rules-in-enterprise-networks/166/1 "2025-03-18T04:04:54Z")

</div>

Going to start writing publicly about some of the research articles I come across my day to day that I enjoy. Going to post more detailed info on my website when I get a chance to fully absorb what I’ve read, but I figured I’d share my findings here with the LimaCharlie group first 😎

Came across some research on evading SIEM Rules: [https://arxiv.org/pdf/2311.10197](https://arxiv.org/pdf/2311.10197) / The FOSS tool built to counter it - AMIDES: [GitHub - fkie-cad/amides: An Adaptive Misuse Detection System](https://github.com/fkie-cad/amides/)

TL;DR:

The researchers analyzed 292 widely used SIEM rules and found that nearly **half** of them can be trivially evaded. Evasion techniques include simple changes like:

• **Insertion:** Adding extra characters to avoid string matching.

• **Substitution:** Using alternative commands/arguments that perform the same function.

• **Omission:** Leaving out optional parameters.

• **Reordering:** Swapping argument order to break strict regex matches.

• **Recoding:** Representing values differently (e.g., IP encoding tricks).

Basically, attackers can tweak their command executions just enough to sidestep detection while still pulling off their objectives.

To counter this, the authors propose **Adaptive Misuse Detection** , which extends traditional rule-based detection with machine learning. The idea is to compare incoming events against both SIEM rules and known-benign events, flagging anything suspicious that **should have** matched a rule but didn’t.

They built **AMIDES** , an open-source tool that does this. Using a large enterprise dataset, AMIDES detected **70% of SIEM rule evasions with zero false positives** —not bad