GraphRAG-Built Detection Rules Survive IOC Rotation, Naive RAG Doesn't

Researchers rotated every IP, domain and file hash in nine real threat reports to test whether LLM-built detection plans survive, per a study posted to arXiv. For any team using an LLM to turn threat reports into detection rules, the retrieval architecture decides whether those rules survive an attacker changing infrastructure. In an APT28 case study, GraphRAG kept 100% of detections firing after rotation; a vector-similarity RAG plan held onto just 29%.

The setup held everything constant except retrieval: same report, same generation prompt, same LLM. The pattern held across all nine reports tested, sourced from four different threat intel vendors. GraphRAG plans consistently reached higher tiers of the Pyramid of Pain, targeting attacker tools and behaviors instead of atomic indicators that rotate in minutes.

Rotating IOCs after a report leaks is standard tradecraft for a burned actor, not an edge case. One caveat matters. The authors found prompt wording moved detection accuracy almost as much as the retrieval backend did.