The Exclusion Ratchet: False-Positive Suppression Accumulates and Persists in Detection Rule Repositories

A nine-year, 8,234-revision study of SigmaHQ shows that exclusions are added 5.4 times more often than withdrawn, 86.7% remain in force after three years, and 64.1% of path-valued exclusions can be satisfied by an unprivileged process choosing a filename.

Sudaroli Dhananjeyan; Kumaran U· 2026· DOI 10.48550/arXiv.2608.31062

The core problem

Detection rules are the operational core of modern security monitoring. When a rule produces too many false alarms, an analyst adds an exclusion so that the rule declines to alert in that circumstance. Each such decision is locally reasonable: it reduces noise, preserves analyst attention, and keeps the rule deployed. What becomes of these decisions collectively, however, has not been known. Recent longitudinal work established that curation does not converge, but it measured restoration time only for revisions that were later reverted. That measure is silent about narrowing that is never undone. This paper addresses that gap by measuring suppression semantically across nine years and 8,234 revisions of the SigmaHQ corpus. The authors define suppression as growth in the set of predicates held under negation without compensating growth in coverage, and they validate the detection against blinded hand labelling with precision 0.828 and recall 0.911. The test is deterministic: nothing is learned from the data, and the definitions are released as code. The central finding is that exclusions were added 1,642 times and withdrawn 304 times, a ratio of 5.4 to 1 that rises to 13 to 1 at the

Innovation

The empirical results are stark. Across the corpus, exclusions were added 1,642 times and withdrawn 304 times, yielding an overall ratio of 5.4 to 1. At the level of the individual rule, the ratio rises to 13 to 1, indicating that rules that acquire exclusions tend to accumulate them. The semantic test found that 31 per cent of the narrowing is invisible to structural comparison, so structural accounts of rule evolution undercount suppression by nearly a third. Persistence is high: estimated by Kaplan-Meier, 86.7 per cent of exclusions remain in force three years after being added. This persistence is independent of whether the rule is the only coverage for its ATT&CK technique, with a log-rank p-value of 0.49, meaning that exclusions are not preferentially retained or removed based on whether they leave a technique uncovered. Of path-valued exclusions, 64.1 per cent can be satisfied by an unprivileged process that chooses a filename. This is a security-relevant finding: an attacker with no special privileges can craft a filename that triggers the exclusion, thereby suppressing the alert. The results collectively show that narrowing accumulates, is rarely revisited, and is not tria

Detection rules are the operational core of modern security monitoring. When a rule produces too many false alarms, an analyst adds an exclusion so that the rule declines to alert in that circumstance. Each such decision is locally reasonable: it reduces noise, preserves analyst attention, and keeps the rule deployed. What becomes of these decisions collectively, however, has not been known. Recent longitudinal work established that curation does not converge, but it measured restoration time only for revisions that were later reverted. That measure is silent about narrowing that is never undone. This paper addresses that gap by measuring suppression semantically across nine years and 8,234 revisions of the SigmaHQ corpus. The authors define suppression as growth in the set of predicates held under negation without compensating growth in coverage, and they validate the detection against blinded hand labelling with precision 0.828 and recall 0.911. The test is deterministic: nothing is learned from the data, and the definitions are released as code. The central finding is that exclusions were added 1,642 times and withdrawn 304 times, a ratio of 5.4 to 1 that rises to 13 to 1 at the level of the individual rule. Thirty-one per cent of the narrowing is invisible to structural comparison, meaning existing structural accounts undercount it. Estimated by Kaplan-Meier, 86.7 per cent of exclusions remain in force three years on, and persistence is independent of whether the rule is the only coverage for its ATT&CK technique (p = 0.49). Of path-valued exclusions, 64.1 per cent can be satisfied by an unprivileged process that chooses a filename. Narrowing accumulates, is rarely revisited, and is not triaged by consequence. The authors give a criterion for deciding which exclusions to examine first.

The study analyses the SigmaHQ corpus over nine years, covering 8,234 revisions. Suppression is detected semantically rather than structurally. Formally, let a rule revision be represented by a pair (P, N) where P is the set of predicates that must hold for an alert and N is the set of predicates held under negation (exclusions). Coverage is the set of log events that satisfy P \land \neg N . A revision from (P_{1}, N_{1}) to (P_{2}, N_{2}) is classified as suppression when the exclusion set grows without a compensating growth in coverage:

Why it matters

The findings describe an exclusion ratchet: each locally reasonable suppression decision adds to a stock of narrowing that is rarely undone. The 5.4 to 1 overall ratio and 13 to 1 per-rule ratio indicate that exclusions are sticky. The Kaplan-Meier estimate that 86.7 per cent remain in force after three years confirms that withdrawal is the exception, not the norm. The independence from sole-coverage status (p = 0.49) is particularly concerning: it suggests that analysts do not prioritise removing exclusions that leave an ATT&CK technique without coverage. The 64.1 per cent figure for path-valued exclusions shows that many suppressions are trivially satisfiable by an unprivileged process choosing a filename, turning a noise-reduction measure into a potential evasion vector. The fact that 31 per cent of narrowing is invisible to structural comparison means that tooling based on syntax alone will miss a substantial fraction of suppression. The authors' deterministic test, released as code, offers a reproducible way to detect semantic suppression. Their criterion for prioritising exclusions provides a practical triage method: examine first those exclusions that are persistent and satisfiable by unprivileged means. The broader implication is that rule repositories require periodic semantic audits, not just structural linting, to prevent the slow accumulation of blind spots. The exclusion ratchet is a collective failure mode of locally optimal decisions, and it is measurable.

Who should read this

CS practitioners and researchers

Opening member content…