diff --git a/rules_bank/run_books/abductive_inference_missing_premise_investigation.md b/rules_bank/run_books/abductive_inference_missing_premise_investigation.md new file mode 100644 index 0000000..d2dd2f1 --- /dev/null +++ b/rules_bank/run_books/abductive_inference_missing_premise_investigation.md @@ -0,0 +1,77 @@ +--- +type: "Playbook" +title: "Abductive Inference and Missing Premise Generation in Security Investigations" +description: "Operational playbook for applying abductive reasoning and missing premise generation to investigate ungrounded telemetry, zero-day alerts, and obfuscated attacker TTPs" +resource: "rules_bank/run_books/abductive_inference_missing_premise_investigation.md" +timestamp: "2026-08-04T18:24:45Z" +provenance: + source_type: "manual" + source_tool: "Antigravity" + timestamp: "2026-08-04T18:24:45Z" +--- + +# Abductive Inference & Missing Premise Generation Playbook + +## 1. Overview + +Standard Retrieval-Augmented Generation (RAG) and SIEM log searches rely on **deductive similarity** (matching query terms directly against known log schemas and runbooks). When faced with novel zero-day exploits, obfuscated PowerShell/script commands, or unknown threat actor techniques, direct similarity queries fail because the raw observation does not match existing signatures. + +This playbook provides step-by-step guidance for executing **Abductive RAG** by generating and validating **Missing Premises** ($P_m \land R \implies O$) before executing database queries or containment actions. + +--- + +## 2. Core Abductive Workflow + +```mermaid +flowchart TD + Obs["Observation O\n(Unexplained Telemetry / Alert)"] --> PremiseGen["Step 1: Abductive Premise Generation\nGenerate Missing Premise P_m\n(P_m ∧ R ⟹ O)"] + PremiseGen --> GraphQuery["Step 2: Targeted Graph & Vector Retrieval\nQuery Neo4j & AlloyDB for P_m"] + GraphQuery --> Validation{"Step 3: Validation Check\nDoes Graph contain evidence for P_m?"} + Validation -- Supported --> Action["Step 4: Execute Targeted Containment\n(Do-Calculus Interventional Scoping)"] + Validation -- Counter-evidence ￢E --> Refine["Step 5: Reject P_m & Refine P_m+1\n(Entropy Minimization)"] + Refine --> PremiseGen +``` + +--- + +## 3. Execution Steps + +### Step 1: Formulate the Missing Premise ($P_m$) +When an alert or telemetry anomaly $O$ lacks an explicit SIEM detection match: +1. Identify the **Observation ($O$)**: What specific event or payload was detected? (e.g. `Custom process svchost_custom.exe opened handle to lsass.exe`). +2. Identify the **General Rule ($R$)**: What core security principle applies? (e.g. `Accessing LSASS memory handles is required to dump domain credentials`). +3. Generate the **Missing Premise ($P_m$)**: What unobserved attacker action or intent explains $O$? (e.g. `Attacker is attempting credential dumping via handle cloning`). + +### Step 2: Targeted Grounding Retrieval +Instead of querying SIEM logs with raw payload strings from $O$, query the knowledge base with $P_m$: +* **Graph Database (Neo4j):** Run Cypher queries for entities associated with $P_m$ (e.g. `MATCH (u:User)-[r:LOGGED_ON_TO]->(h:Host) WHERE h.name = $target RETURN path`). +* **Vector Store (AlloyDB / Elasticsearch):** Query historical incident reports using semantic embedding of $P_m$ (`query_alloydb_detection_reports`). + +### Step 3: Dual-Loop Validation Check +Verify whether the retrieved evidence supports or invalidates $P_m$: +* **Supporting Evidence ($E$):** Prior privilege escalation events, abnormal network connections, or matching past detection reports. +* **Counter-Evidence ($\neg E$):** Known IT administrative automation schedules, approved patch management scripts, or verified system service hashes. + +### Step 4: Interventional Blast Radius Containment +Before triggering destructive containment (e.g., host isolation), evaluate Pearl's **Do-Calculus operator** $\text{do}(\text{isolate}(H))$: +1. Query Neo4j for dependent active services running on host $H$. +2. Verify that host isolation will not cause unpredicted cascade outages on non-compromised production systems. +3. Execute gated containment with full audit logging. + +### Step 5: Iterative Premise Refinement +If counter-evidence $\neg E$ invalidates premise $P_m$: +1. Reject $P_m$. +2. Formulate refined candidate premise $P_{m+1}$ using entropy minimization: + +$$\hat{P}_m = \arg\min_{P_m} \left[ H(P_m \mid R) + \alpha \cdot D_{KL}(P(O \mid P_m, R) \parallel P(O \mid R)) \right]$$ + +3. Re-evaluate against the grounding databases until convergence ($\le 3$ turns). + +--- + +## 4. References & Academic Citations + +* **Josephson, J. R., & Josephson, S. G. (1994).** *Abductive Inference: Computation, Philosophy, Technology*. Cambridge University Press. +* **Pearl, J. (2009).** *Causality: Models, Reasoning, and Inference* (2nd ed.). Cambridge University Press. +* **Evans, O., Stuhlmüller, A., & Goodman, N. D. (2023).** *"The Optimal Choice of Hypothesis Is the Weakest, Not the Shortest"*. [arXiv:2301.12987v4](https://arxiv.org/abs/2301.12987). +* **Milajerdi, S. M., et al. (2019).** *"HOLMES: Real-time APT Detection through Correlation of Suspicious Events Targeted Towards a High-level Attack Graph"*, IEEE S&P '19. diff --git a/skills/abductive-inference/SKILL.md b/skills/abductive-inference/SKILL.md new file mode 100644 index 0000000..3eb8078 --- /dev/null +++ b/skills/abductive-inference/SKILL.md @@ -0,0 +1,74 @@ +--- +name: secops-abductive-inference +description: Guidance for generating and validating missing premises (Abductive RAG) during zero-day investigations and unexplained alert triage. Use when asked to "generate missing premises", "apply abductive reasoning", or investigate alerts lacking explicit SIEM rules. +slash_command: /secops:abductive +category: security_operations +personas: + - threat_hunter + - tier2_analyst +metadata: + author: Google SecOps Extension + version: 1.0.0 +--- + +# Abductive Inference & Missing Premise Agent Skill + +You are an expert Security Operations AI Agent specialized in **Abductive Inference** and **Missing Premise Generation ($P_m \land R \implies O$)**. Your goal is to infer unobserved attacker mechanisms and validate them against graph and vector grounding when standard deductive log matching fails. + +--- + +## Operating Workflow + +```mermaid +flowchart TD + Obs["Observation O\n(Telemetry Anomaly / Alert)"] --> Step1["1. Abductive Premise Generation\nGenerate P_m such that P_m ∧ R ⟹ O"] + Step1 --> Step2["2. Targeted Grounding Query\nQuery Neo4j Graph & AlloyDB Embeddings"] + Step2 --> Step3{"3. Validation Check\nDoes Graph contain evidence for P_m?"} + Step3 -- Supported --> Step4["4. Do-Calculus Interventional Scoping\nEvaluate do(isolate(H)) before containment"] + Step3 -- Counter-evidence ￢E --> Step5["5. Entropy Minimization Refinement\nReject P_m and generate P_m+1"] + Step5 --> Step1 +``` + +--- + +## Step-by-Step Procedure + +### 1. Identify Observation ($O$) & Rule Base ($R$) +* **Observation ($O$):** Extract the ungrounded telemetry anomaly or alert details (e.g. `svchost_custom.exe opened handle to lsass.exe`). +* **Rule Base ($R$):** Identify general security physics (e.g. `LSASS memory handles are required to dump domain credentials`). + +### 2. Formulate Missing Premise ($P_m$) +* Generate candidate missing premise: `Attacker is attempting credential dumping via handle cloning`. +* Ensure premise $P_m$ minimizes entropy $H(P_m \mid R)$ (Principle of Maximum Weakness, Evans et al., 2023). + +### 3. Query Dual Grounding (Neo4j & AlloyDB) +* **Graph Traversal (Neo4j):** Query multi-hop relationships using Cypher: + ```cypher + MATCH path = (u:User)-[r:LOGGED_ON_TO|CONNECTED_TO*1..3]-(target) + WHERE target.name = $entity_name + RETURN path + ``` +* **Vector Similarity (AlloyDB):** Execute semantic vector query against historical detection reports: + ```python + query_alloydb_detection_reports(query=f"abductive premise: {P_m}", semantic=True) + ``` + +### 4. Dual-Loop Validation Check +* **Check Grounding Evidence:** Verify if graph topology or vector reports support $P_m$. +* **Check Counter-Evidence ($\neg E$):** Look for legitimate IT administrative automation scripts (Ansible, SCCM). +* **Decision:** + * If supported and no counter-evidence: Accept $P_m$ as confirmed hypothesis. + * If counter-evidence $\neg E$ exists: Reject $P_m$ and proceed to Step 5. + +### 5. Interventional Containment ($P(y \mid \text{do}(x))$) +Before executing containment (e.g., host isolation), evaluate Do-Calculus: +1. Verify dependent active services on host $H$. +2. Ensure isolation will not cause cascade outages on non-compromised production dependencies. + +--- + +## References + +* **Josephson & Josephson (1994):** *Abductive Inference*, Cambridge University Press. +* **Pearl, J. (2009):** *Causality: Models, Reasoning, and Inference*, Cambridge University Press. +* **Evans et al. (2023):** *The Optimal Choice of Hypothesis Is the Weakest, Not the Shortest*, arXiv:2301.12987v4.