GReAT-BeD: Graph Rewriting for Activity Tracking and (Malicious) Behaviour Detection

Living-off-the-Land is a cyberattack technique where cybercriminals exploit legitimate pre-installed tools within the victims’ system. These attacks are particularly challenging to detect due to their subtle and legitimate appearance, allowing threat actors to ”hide in plain sight.” This paper introduces a novel framework for identifying potentially malicious high-level behaviours using graph rewriting techniques. Our approach employs a three-layered methodology: the low-level layer captures system events and command-line data, the system behavior graph layer aggregates this data into meaningful behaviors, and the Indicators of Attack graph layer identifies high-level attack patterns through graph rewriting rules. We developed a general approach to generate a system behaviour graph from lower-layer as well as 27 rewriting rules to automatically transform this graph into Indicators of Attack representations, capturing complex behaviours and information flows. We implemented the transformation rules in the Attributed Graph Grammar System program and applied them to two use cases to demonstrate the effectiveness of our method in identifying potentially malicious behaviours across various attack scenarios.