Deterministicfirst.Proselast.
Everything a human needs to act on is extracted from the session record by rules: techniques, indicators, signature candidates, campaign membership. Exactly one language-model call happens after all of that, and its only output is the paragraph a human reads first.
The order matters
If the model ran first, or anywhere upstream, attacker-controlled log content would be shaping security decisions. Running it last, on a finished record, makes it a reader rather than an actor.
Record
L5 closes the session record: PTY transcript, command sequence, tool fingerprints, file operations, persistence attempts, pivot targets, payloads.
Map
Roughly sixty deterministic command-to-technique rules produce the ATT&CK set. Same transcript, same output, every time.
Extract
Indicators and signature candidates are lifted by pattern, not inference. Addresses, hostnames, dropped paths, tooling.
Correlate
L7 places the session against existing campaigns using fingerprint distance and TTP-sequence distance. A similarity claim, nothing more.
Narrate
One LLM call, post-session, over the finished structured record. It writes the summary. It cannot act on it.
What fired, across the recorded sessions
Grouped the way the tactics group. Bar length is the weight the rule adds to the score, so the shape of each group is the shape of that tactic: discovery is a lot of small contributions, execution is a few big ones.
Execution
4 rules- T1190SQL injection payload14
- T1190.001Insecure deserialisation14
- T1090Server-side request forgery11
- T1083.001Path traversal sequence9
Credential access
4 rules- T1552.005Cloud metadata request12
- T1003.008/etc/shadow read11
- T1552.004Private key harvesting10
- T1552.001Credentials in files9
Persistence
2 rules- T1098.004authorized_keys write12
- T1053.003Cron job installation11
Exfiltration
2 rules- T1041Exfiltration over C212
- T1105Ingress tool transfer10
Defense evasion
1 rules- T1070.003History truncation9
Privilege escalation
1 rules- T1548.001Setuid binary search8
Discovery
10 rules- T1046Network service scanning7
- T1518.001Security software discovery5
- T1087.001Local account enumeration4
- T1049Network connection discovery4
- T1083File and directory discovery3
- T1518Software discovery3
- T1057Process discovery3
- T1016Network configuration discovery3
- T1033System owner discovery2
- T1082System information discovery2
Campaigns are similarity, not identity.
Clustered on fingerprint distance and TTP-sequence distance. Nothing here names anyone, and nothing here is meant to.
Metadata-first credential sweep
- SSRF probe before any credential access
- 169.254.169.254 requested within 40s of first enumeration
- Identical ordering: discovery → network → metadata
Clusters on sequence, not on fingerprint. The two sessions share almost no connection-level signal.
Automated injection sweep
- python-requests/2.31.0 with a fixed JA4
- Sub-second request spacing
- No reconnaissance phase at all
One session so far. Tight fingerprint, so new members will match quickly if they arrive.