arXiv:2606.18651v1 [cs.CR] 17 Jun 2026
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences Guo-Wei Wong
Ming-Chuan Yang
Shou-De Lin
National Taiwan University Taiwan
National Taiwan Ocean University Taiwan
National Taiwan University Taiwan
Wang-Chien Lee
Meng Chang Chen
Pennsylvania State University USA
Academia Sinica Taiwan
Abstract
Keywords
In enterprise environments, multiple Advanced Persistent Threat (APT) campaigns may execute concurrently, producing audit logs in which techniques from different adversaries are temporally interleaved. This setting gives rise to the Unknown-K Interleaved Sequence Demixing (UKISD) problem, where the goal is to recover latent campaigns from a mixed technique sequence while jointly inferring the number of campaigns and technique-level assignments. Existing approaches, including statistical pattern mining and provenance-based analysis, typically assume single-campaign settings or rely on rigid heuristics, limiting their effectiveness under realistic conditions such as overlapping campaigns, shared techniques, and variable execution lengths. We propose Topic-Guided Consistency Modeling (TGCM), a generative disentanglement framework for UKISD. TGCM models interleaved observations as the superposition of multiple latent campaigns and learns a direct inverse mapping to structured singlecampaign sequences using Consistency Models, enabling efficient single-step inference. To guide decomposition, TGCM incorporates a topic-based semantic prior derived from MITRE ATT&CK narratives, encouraging coherent kill-chain reconstruction under technique reuse. We evaluate TGCM on synthetic datasets, mixed established benchmarks, and real-world traces from DARPA TC-E3 and TC-E5, comparing against 15 representative baselines spanning statistical, deep learning, and LLM-based methods. Results show that TGCM consistently improves technique-level attribution under heavy interleaving and technique sharing, and generalizes zero-shot to naturally interleaved real-world scenarios without retraining.
advanced persistent threats, unknown-K interleaved sequence demixing, topic-guided disentanglement, consistency models, MITRE ATT&CK
CCS Concepts • Security and privacy → Network security; • Computing methodologies → Learning latent representations.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. CCS ’26, The World Forum, The Hague, The Netherlands © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-x-xxxx-xxxx-x/YYYY/MM https://doi.org/XXXXXXX.XXXXXXX
ACM Reference Format: Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen. 2026. TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences. In Proceedings of CCS ’26: 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS ’26). ACM, New York, NY, USA, 36 pages. https://doi.org/XXXXXXX.XXXXXXX
1
Introduction
Advanced Persistent Threats (APTs) [61] pose a significant challenge to modern enterprise security due to their stealthy, multistage, and long-running nature. These campaigns often unfold over extended periods, interleaving malicious actions with benign system activities to evade detection. Prior work detects APT campaigns either directly from audit logs [19, 75] or from intermediate representations derived from these logs [3, 16, 24, 44, 48]. Many systems further abstract low-level system events into higher-level adversarial behaviors, commonly represented using MITRE ATT&CK techniques, to facilitate downstream reasoning. These abstraction and detection methods encompass a broad range of approaches, including provenance analysis, representation learning, and graphbased matching, among others [4, 19, 51]. This work targets an operational network-security setting where defenders reason over ATT&CK-aligned evidence derived from host and network telemetry. Even after upstream detectors identify suspicious techniques, concurrent intrusions may produce a mixed evidence stream. We therefore focus on campaign-level attribution: determining which observed techniques belong to which latent APT campaign for SOC triage and incident scoping. However, most existing approaches implicitly assume that each observed sequence corresponds to a single attack campaign. In operational environments, this assumption often breaks down: multiple APT campaigns may execute concurrently within the same infrastructure, producing audit logs in which techniques from different adversaries are temporally interleaved [2, 17, 69, 79]. As illustrated in Table 1, real-world incidents may contain activities from multiple campaigns within a single timeline, resulting in mixed technique sequences without explicit campaign boundaries. A key challenge is to develop effective methods for handling interleaved APT activities. End-to-end approaches that attempt to infer concurrent campaigns directly from raw audit logs are both
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
# Technique
Tactic (TA)
APT
1 T1190 ProxyShell exploit TA0001 Initial Access IAB 2 T1505.003 Web shell TA0003 Persistence IAB 3 T1136 Create admin account TA0003 Persistence IAB 4 T1021.001 RDP TA0008 Lateral Movement Karma 5 T1059.001 PowerShell TA0002 Execution Conti 6 T1543.003 Service (beacon) TA0003 Persistence Conti 7 T1560.001 Archive (RAR) TA0009 Collection Karma 8 T1567.002 Exfil to cloud (Mega) TA0010 Exfiltration Karma 9 T1569.002 Service exec (note) TA0002 Execution Karma 10 T1218.010 regsvr32 proxy exec TA0005 Defense Evasion Conti 11 T1562.001 Disable Defender TA0005 Defense Evasion Conti 12 T1047 WMI TA0007 Discovery Conti 13 T1518.001 Sec SW discovery TA0007 Discovery Conti 14 T1567.002 Exfil to cloud TA0010 Exfiltration Conti 15 T1486 Encrypt for impact TA0040 Impact Conti
Table 1: Merged, chronological technique-level view of a realworld multi-ransomware incident with interleaved activities from Initial Access Broker (IAB), Karma, and Conti, adapted from Zaidi et al. [79].
computationally expensive and inherently difficult to scale. A more practical approach is to decompose the problem into two stages: first, abstracting malicious activities into technique-level sequences, and second, identifying individual campaigns from these mixed sequences. This motivates a post-detection attribution layer: given an ATT&CK technique sequence already abstracted from telemetry, the goal is to separate techniques into campaign-consistent sequences under unknown 𝐾. This targets the semantic ambiguity left after log-to-technique extraction, which provenance detectors and sequence classifiers do not directly solve. To systematically address this challenge, we formalize this setting as the Unknown-K Interleaved Sequence Demixing (UKISD) problem, where the goal is to recover latent campaigns from a mixed technique sequence while jointly inferring their number and technique-level assignments, i.e. demixing the superimposed campaigns to recover individual campaigns. This problem subsumes classical string unshuffling [12, 13] and is NP-hard in general. Solving UKISD is inherently challenging. First, APT campaigns share a common vocabulary of techniques (e.g., T1059 PowerShell execution), making frequency- or correlation-based heuristics unreliable under temporal overlap. Second, real-world observations are noisy and incomplete, further complicating attribution. Existing sequence disentanglement methods are not designed for this setting. Statistical approaches such as Hidden Markov Models (HMMs) [23] and Frequent Episode Mining (FEM) [21] rely on local statistics and struggle to capture long-range dependencies under heavy interleaving. Structural approaches, such as Object-Centric Petri Nets (OCPNs) [71], impose causal constraints but lack the semantic expressiveness needed to disambiguate shared techniques or infer attacker intent. More broadly, prior methods either assume a fixed number of sources or encode mixed observations holistically without explicitly disentangling latent campaigns. We argue that mixed-APT analysis should be viewed as a generative disentanglement problem rather than a discriminative or clustering task. Specifically, an observed technique sequence can be interpreted as the superposition of multiple latent campaigns. Recovering individual campaigns then corresponds to learning an inverse mapping from interleaved observations to structured, campaign-consistent sequences. This perspective naturally accommodates unknown 𝐾, preserves temporal dependencies, and enables
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
principled reasoning under shared techniques and partial observability. Motivated by this perspective, we propose Topic-Guided Consistency Modeling (TGCM), a generative framework for disentangling interleaved APT technique sequences. Figure 1 (a) first illustrates the forward mixing process, where multiple single-campaign technique sequences are interleaved to form a mixed observation. As shown in Figure 1 (b), TGCM models an observed sequence as a mixture of latent campaigns and learns an inverse mapping that directly recovers structured single-campaign sequences. TGCM integrates three key components, as shown in Figure 1 (b). First, it incorporates a topic-guided semantic prior derived from a neural topic model (FASTopic [73]) pretrained on MITRE ATT&CK narratives, encouraging coherent kill-chain progression and disambiguation of shared techniques. Second, a Transformer encoder captures contextual dependencies within the interleaved sequence, modeling long-range interactions across techniques. Third, TGCM leverages consistency models [65] to learn an inverse mapping from mixed sequences to disentangled outputs, enabling single-step inference that is substantially more efficient than iterative generative approaches such as diffusion models [18, 30, 54]. Because real-world logs rarely provide ground-truth campaign decompositions, we construct training data using a controlled forward mixing process over technique sequences. This design serves as a standardized training surrogate rather than a strict model of real-world concurrency. We validate that TGCM generalizes beyond this synthetic setting through zero-shot evaluation on real-world datasets (e.g., DARPA TC-E3 and DARPA TC-E5), where interleaving arises naturally without controlled mixing, and through robustness analysis under realistic perturbations such as missing, spurious, and substituted techniques. We conduct extensive experiments on synthetic datasets, benchmark scenarios, real-world traces, and an end-to-end evaluation on CAPTure under unknown mixture cardinality 𝐾. TGCM is compared against a diverse set of baselines, including statistical, structural, and deep learning methods. Results show that TGCM consistently improves technique-level attribution accuracy and robustness under heavy interleaving and temporal noise, while maintaining efficient inference through its single-step design. Our contributions are summarized as follows:
• Problem formulation. We formalize mixed-APT analysis as the UKISD problem, connecting it to blind source separation over discrete technique sequences. • Generative disentanglement framework. We propose TGCM for sequence disentanglement under unknown 𝐾. • Semantic and efficient modeling. TGCM integrates topic priors and consistency learning for coherent, interpretable, and efficient single-step disentanglement. • Deployment-oriented benchmark. We introduce CAPTure, enabling end-to-end evaluation under noisy upstream extraction and unknown 𝐾. • Comprehensive evaluation. We demonstrate strong performance and generalization across synthetic and benchmark datasets under interleaving, noise, and unseen attack scenarios.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Figure 1: Overview of the TGCM framework. In the (a) forward process, multiple APT campaigns are interleaved to produce a mixed technique sequence 𝑥𝑡 . In the (b) inverse mapping stage, TGCM uses a unified demixing module, consisting of a topic model, a Transformer encoder, and a consistency-based learning objective, to infer the number of latent campaigns 𝐾ˆ and the ˆ from which the campaign-level subsequences are recovered. per-technique campaign assignments 𝑦,
2
• Rule-based provenance analysis. Early systems [50, 51, 80] construct dependency graphs and apply expert-defined rules to infer high-level attack scenarios. • Graph-based learning. Subsequent approaches incorporate causal reasoning [29, 41] or graph representation learning [16, 27] for anomaly detection and attack inference. • Sequence-based modeling. ATLAS [3] models attack evidence as ordered sequences, enabling chronological reasoning for multi-stage APT analysis. • Fine-grained technique recognition. Recent methods, such as TREC [48] and NODLINK [44], focus on identifying individual techniques via few-shot learning or online sequence summarization.
Preliminaries
This section introduces the abstraction of system audit logs into technique sequences, outlines the challenges of demixing interleaved technique sequences, and clarifies the scope and assumptions of this work.
2.1
Abstraction of Technique Sequences
System-level audit logs record security-relevant operating system activities, including process execution, file access, registry modification, and network communication. Such logs are collected by widely deployed platforms such as Procmon, ETW, Sysmon, Linux audit, and CamFlow. A log event is commonly represented as a triple ⟨subject, operation, object⟩. In practice, audit logs are high-volume and heterogeneous, making direct campaign-level reasoning over raw events both computationally expensive and semantically fragile. To support higher-level reasoning, audit logs are commonly abstracted into sequences of MITRE ATT&CK techniques [66], referred to as technique sequences. An APT campaign can then be viewed as an ordered sequence of techniques, e.g., Spearphishing Attachment → Command and Scripting Interpreter → Credential Dumping → Exfiltration Over C2 Channel. This abstraction enables campaign-level analysis while remaining consistent with analyst workflows and existing SOC practices. A range of upstream systems perform the abstraction by mapping audit logs to ATT&CK-aligned representations:
These upstream systems are complementary to TGCM rather than competing methods: they transform raw audit logs into ATT&CKaligned technique sequences, whereas TGCM operates on these sequences to disentangle temporally interleaved campaigns.
2.2
Challenges in Demixing Technique Sequences
In operational environments, observed mixed technique sequences deviate substantially from the idealized single-campaign setting due to the following factors: • Scale and low signal-to-noise ratio. Enterprise audit data is large-scale, with malicious behaviors sparsely embedded among dominant benign activities.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
These challenges jointly motivate the need for principled methods to demix interleaved technique sequences, as formalized by the UKISD problem.
• Partial observability. Core logging remains available, but observations may be incomplete due to deployment or collection limitations. An adaptive adversary may further increase ambiguity through mimicry (reusing common techniques), chaff injection (introducing misleading steps), or deliberate interleaving across campaigns. We treat these effects as corruption in the extracted technique sequence. This work does not address evasion at the telemetry or techniqueextraction stage. Instead, we focus on disentangling and attributing the technique sequences produced by upstream systems.
2.3
3.2
• Interleaving and technique reuse. Multiple campaigns may overlap temporally, and commonly used techniques may appear across different campaigns, introducing inherent attribution ambiguity. • Incomplete observability. Campaign traces may be partially observed due to limited logging coverage, sensor failures, or collection constraints.
Scope and Assumptions
We explicitly distinguish operational reality from the scope of this work. • Post-abstraction setting. TGCM operates as a downstream reasoning module and does not attempt to correct errors introduced by upstream technique extraction. • Limits of identifiability. When extracted sequences are severely corrupted, latent campaigns may become difficult to identify, as the available observations may not provide sufficient signal for reliable inference. • Closed technique vocabulary. TGCM assumes a fixed MITRE ATT&CK technique vocabulary. Newly introduced techniques or previously unseen adversary behaviors are not explicitly modeled. • Unknown number of campaigns. The number of latent campaigns, denoted by 𝐾, is unknown a priori and may vary across inputs. • Technique-level inputs. Inputs consist of extracted ATT&CK techniques, with benign events filtered upstream; techniques may recur across campaigns. • Noise-free surrogate. For formulation and controlled evaluation, we assume a noise-free mixed surrogate in which sequences are formed by interleaving complete single-APT traces without upstream extraction errors. This assumption is relaxed in Section 5.7 via end-to-end evaluation on noisy sequences. • Partial observability. Observed sequences may be incomplete due to logging gaps or collection limitations. These preliminaries establish the foundation for the UKISD formulation and the TGCM framework presented in the next sections.
3
Threat Model and Problem Formulation
This section specifies the adversary model and defender capabilities, formalizes the UKISD problem, and analyzes its inherent challenges.
3.1
Adversary Model
We consider one or more APT actors executing multi-stage intrusion campaigns within a shared enterprise environment. We assume: • Concurrent campaigns. Multiple campaigns may execute concurrently and interleave temporally. • Technique reuse. Techniques may be reused across campaigns (e.g., T1105 in Figure 2), creating intrinsic attribution ambiguity.
Defender Capabilities
At test time, the defender observes only an inferred ATT&CK technique sequence, without access to raw audit events, provenance graphs, or ground-truth campaign boundaries. To isolate the core UKISD problem, we adopt a noise-free mixed surrogate for formulation and controlled evaluation, where sequences are constructed by interleaving complete single-APT technique traces without upstream extraction errors. TGCM operates as a downstream reasoning module over technique-level abstractions and is not intended to replace upstream detection systems, such as log-based or provenance-graph-based approaches.
3.3
UKISD Problem Formulation
Let V denote the vocabulary of MITRE ATT&CK techniques. Given an observed mixed technique sequence 𝑥 obs = [𝑤 1, 𝑤 2, . . . , 𝑤𝑛 ],
𝑤𝑖 ∈ V,
the goal is to jointly infer: • the number of latent campaigns 𝐾, and • a technique-level assignment vector 𝑦ˆ ∈ {0, 1, . . . , 𝐾 }𝑛 , where 𝑦ˆ𝑖 indicates the campaign responsible for 𝑤𝑖 (with 0 optionally denoting residual or unassigned elements). Equivalently, the output can be viewed as a set of 𝐾 order-preserving ˆ subsequences extracted from 𝑥 obs according to 𝑦. Figure 2 illustrates the UKISD problem. Cases (a) and (b) correspond to two independent APT campaigns, while Case (c) shows their interleaved observation. The task is to recover the original campaigns and assign each technique to its source. For example, a correct solution yields 𝐾=2 and an assignment vector 𝑦ˆ = [2, 2, 1, 2, 1, 1, 1, 1, 2, 1, 1], where 1 denotes the orange campaign and 2 denotes the blue campaign, that separates the mixed sequence into the two underlying campaigns.
3.4
Problem Analysis
Given a mixed technique sequence, the defender must jointly infer the unknown campaign count and assign each technique to a latent source. This problem exhibits structural non-identifiability: interleaved sources, unknown 𝐾, and shared technique usage jointly create ambiguity that cannot be resolved by local heuristics or purely discriminative models. A practical solution should satisfy the following requirements: • (R1) Order awareness: preserve campaign-internal temporal structure. • (R2) Automatic 𝐾 inference: operate without prior knowledge of campaign count.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Figure 2: Events are ordered from left to right. Case (c) merges techniques from two distinct APT campaigns ( blue vs. orange ). Case
Technique sequence extracted by the upstream system
(a) Single APT (𝑖)
Idle
Idle
T1566.001
Idle
T1069.003
T1497.001
T1003.001
T1224
Idle
T1201
(b) Single APT (𝑖+1)
T1566.001
T1059.001
Idle
T1105
Idle
Idle
Idle
Idle
T1112
Idle
Idle
(c) Mixture of (a) and (b)
T1566.001
T1059.001
T1566.001
T1105
T1069.003
T1497.001
T1003.001
T1224
T1112
T1201
T1105
• (R3) Robustness: handle technique reuse and partial observations. • (R4) Efficiency: scale to long technique sequences. • (R5) Log independence: rely only on technique sequences, without requiring raw event graphs. Existing approaches fail to satisfy these requirements simultaneously [38]. Bag-of-techniques methods discard temporal structure [43]. HMM-based models assume a fixed model order and require specifying the number of latent states in advance [7]; even extensions such as factorial HMMs still rely on a predefined number of latent chains [22]. Provenance-based approaches depend on system-level attributes that are unavailable in this setting [27, 51]. Discriminative sequence models typically encode mixed observations holistically rather than explicitly disentangling latent campaigns [20, 26]. We therefore approach UKISD as a generative disentanglement problem, aiming to invert the superposition of latent campaigns under structural and semantic inductive biases. This formulation motivates the TGCM framework presented in the next section.
4
TGCM: A Generative Disentanglement Framework 4.1 Overview To address the UKISD problem, we propose Topic-Guided Consistency Modeling (TGCM), a generative disentanglement framework that operates on technique-level sequences without access to raw telemetry (satisfying R5: Log-independence). We summarize the adopted symbols and their definitions in Appendix Table 9. TGCM models an observed sequence as the superposition of multiple latent campaigns and learns a direct inverse mapping that recovers canonical single-campaign sequences and technique-level assignments. The framework consists of three components, explicitly designed to satisfy the remaining requirements (R1–R4): • Semantic prior learning (Section 4.2). A neural topic model (FASTopic [73]) captures latent semantic structure from MITRE ATT&CK narratives, providing a semantic prior that encourages coherent kill-chain progression and resolves ambiguities under technique reuse (R1: Order-awareness and R3: Robustness). • One-step generative demixing (Section 4.3). A consistency model [65] learns a direct inverse mapping from a mixed sequence 𝑥𝑡 to a clean sequence 𝑥ˆ0 , enabling efficient singlestep inference (R4: Efficiency).
T1105
• Sequence restoration and attribution (Section 4.6). TGCM jointly optimizes reconstruction fidelity and semantic consistency to reconstruct the clean sequence and predict techniqueˆ allowing estimation of the unknown level assignments 𝑦, number of campaigns (R2: Auto-𝐾). An information-theoretic interpretation is also provided in Appendix F.
4.2
Topic Modeling with FASTopic
To incorporate domain knowledge, we pre-train a neural topic model using FASTopic [73] over ATT&CK technique descriptions. FASTopic uses a security-oriented BERT encoder, such as SecBERT [35], CYBERT [59] or CTI-BERT [55], to infer soft topic allocations. This topic model provides a semantic prior that encourages plausible kill-chain progression (R1) and helps resolve ambiguities caused by technique reuse (R3). Let 𝐾topic be the number of latent topics, 𝛽 be the topic–word matrix learned by FASTopic, and 𝜃 (𝑠𝑘 ) be the soft topic allocation of a single-APT campaign sequence 𝑠𝑘 . For each 𝑠𝑘 , we concatenate the ATT&CK descriptions of all techniques in 𝑠𝑘 into one campaignlevel document; the complete technique-description mapping is provided in Appendix H; we then train FASTopic over these documents. Thus, FASTopic captures topic-level semantics of complete singleAPT campaigns, while TGCM reconstructs mixed sequences whose elements are ATT&CK techniques. We use the mapping matrix 𝑀 to convert the FASTopic word-level distribution into a prior over the technique vocabulary V: 𝜔 (𝑠𝑘 ) = Norm 𝜃 (𝑠𝑘 ) ⊤ softmax(𝛽)𝑀 , (1) where 𝜔 (𝑠𝑘 ) is a probability distribution over ATT&CK techniques in V, and Norm(·) normalizes the vector into a valid distribution. Entries corresponding to special symbols are excluded from the topic prior. During training, TGCM uses this prior to regularize reconstruction of the input mixed technique sequence 𝑥𝑡 . Let ℓrec denote the reconstruction logits predicted by TGCM before topic fusion. For each position whose campaign label in 𝑦 corresponds to source campaign 𝑠𝑘 , we add the log-prior bias to obtain the topic-fused logits: ℓfused = ℓrec + 𝜆 log(𝜔 (𝑠𝑘 ) + 𝜖) , (2) where ℓfused denotes the logits after topic fusion, 𝜆 controls the strength of the topic prior, and 𝜖 is a small constant for numerical stability. The reconstruction objective is computed against the canonical clean sequence 𝑥 0 , since TGCM learns an inverse mapping from mixed states to the clean campaign structure:
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
ℓCE = CE(ℓfused, 𝑥 0 ).
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
(3)
In addition, we use a topic alignment loss to encourage the topic distribution induced from TGCM predictions to match the FASTopic allocation: 1 ∑︁ ℓtopic = − 𝜃 (𝑠𝑏 ) log 𝜃ˆ𝑏 + 𝜖 , (4) 𝐵 𝑏
where 𝐵 is the batch size, 𝑠𝑏 is the source campaign sequence associated with the 𝑏-th training instance, and 𝜃ˆ𝑏 is the topic distribution inferred from TGCM’s predicted technique distribution. The topic-guided training objective combines reconstruction, campaign-label prediction, and topic regularization: Ltopic = 𝑤 ce ℓCE + 𝑤 topic ℓtopic,
(5)
where 𝑤 ce, 𝑤 topic are scalar weights. Because the topic prior is defined over the current ATT&CK vocabulary V, TGCM does not explicitly model out-of-vocabulary techniques at inference time. Newly introduced techniques can be handled by updating V, rebuilding 𝑀, and recomputing the topic prior.
4.3
Topic-Conditioned Consistency Model
To enable efficient single-step disentanglement (R4), we employ a consistency model 𝑓𝜃 (𝑥𝑡 , 𝑡; 𝑐 topic ) that directly estimates the clean sequence 𝑥ˆ0 from a mixed input 𝑥𝑡 . Each technique in 𝑥𝑡 is mapped to a 𝑑-dimensional embedding via a learnable input matrix 𝑊in ∈ R | V | ×𝑑 , yielding 𝐸𝑡 = Embed(𝑥𝑡 ;𝑊in ). The embeddings 𝐸𝑡 are then processed by a Transformer encoder backbone to capture contextual dependencies. To incorporate semantic guidance, the topic prior 𝑐 topic is injected into the Transformer layers via Adaptive Layer Normalization (AdaNorm [76]). An intermediate hidden state ℎ is modulated as follows. AdaNorm(ℎ, 𝑐 topic ) = 𝛾 (𝑐 topic ) ⊙ LN(ℎ) + 𝛽 (𝑐 topic )
⊤ logits = 𝐸ˆ0𝑊out .
(7)
Here, 𝑊out ∈ R | V | ×𝑑 denotes the output vocabulary projection matrix that maps technique embeddings back to vocabulary logits. We optionally tie the input and output embeddings by setting𝑊out = 𝑊in .
4.4
4.5
Reconstruction and Attribution Objectives
To ensure accurate order recovery (R1) and distinct campaign attribution (R3), we optimize two supervised objectives. First, we apply technique-wise cross-entropy on the reconstructed sequence: LCE = E CE(logits𝜃 , 𝑥 0 ) . (9) Second, we introduce an auxiliary campaign-label classifier to predict technique-level assignments: Lapt = E CE(logitsapt, 𝑦) . (10) The attribution loss Lapt encourages the model to learn distinct representations for different campaigns, even when they share similar techniques.
4.6
Topic-Aware Regularization and Overall Objective
The topic alignment loss Ltopic acts as a regularizer that ties model predictions to ATT&CK-derived semantic priors. By discouraging locally plausible but globally inconsistent reconstructions, it improves robustness under technique reuse (R3). The overall training objective combines consistency, reconstruction, attribution, and topic-based regularization: L = 𝑤 1 Lconsist + 𝑤 2 LCE + 𝑤 3 Lapt + 𝑤 4 Ltopic .
(11)
Equations 1–7 define the topic-conditioned reconstruction path, while Equation 11 integrates all objectives. Ablation results show that removing topic-aware terms significantly degrades demixing performance, particularly when campaigns share overlapping techniques.
(6)
where 𝛾 and 𝛽 are learned projections of the timestep and topic features, and LN denotes Layer Normalization [6]. This conditioning allows the model to resolve shared techniques using the surrounding tactical context. We implement 𝑓𝜃 by predicting an embedding-space residual 𝑟ˆ𝜃 . The clean estimate is formed through a time-dependent gate 𝑎(𝑡): 𝐸ˆ0 = 𝐸𝑡 − 𝑎(𝑡) 𝑟ˆ𝜃 (𝐸𝑡 , 𝑡; 𝑐 topic ),
This objective encourages all mixed states along the trajectory to map to a common canonical sequence, thereby enabling consistent and stable single-step reconstruction.
Consistency Boundary Condition
To enable stable one-step inference (R4), we enforce time-invariant reconstruction along the forward mixing trajectory. Specifically, we train on pairs (𝑥𝑡1 , 𝑥𝑡2 ) sampled from the same trajectory and penalize discrepancies between their reconstructed clean sequences: Lconsist = E ∥𝑥ˆ0,𝜃 (𝑥𝑡1 , 𝑡 1 ) − 𝑥ˆ0,𝜃 (𝑥𝑡2 , 𝑡 2 )∥ 22 . (8)
4.7
Inference Procedure
At inference time, the defender observes a mixed technique sequence 𝑥 obs without knowing the true mixture cardinality 𝐾. TGCM performs a single forward pass to predict the reconstructed clean sequence 𝑥ˆ0 and the technique-level campaign assignment probabilities 𝑝𝜃 (𝑦𝑖 = 𝑘 | 𝑥 obs ) for each technique occurrence 𝑖 and candidate campaign slot 𝑘 ∈ {1, . . . , 𝐾max }. To infer the unknown campaign count (R2), TGCM first computes a hard assignment for each technique occurrence, 𝑦ˆ𝑖 = arg
max
𝑘 ∈ {1,...,𝐾max }
𝑝𝜃 (𝑦𝑖 = 𝑘 | 𝑥 obs ).
(12)
It then estimates the number of latent campaigns by counting the non-empty assignment slots: 𝐾ˆ = |{𝑘 ∈ {1, . . . , 𝐾max } : ∃𝑖 s.t. 𝑦ˆ𝑖 = 𝑘 }| .
(13)
TGCM decodes under a fixed budget 𝐾max , with the effective campaign count given by the number of occupied slots. When each latent campaign maps to a distinct slot and unused slots remain empty, this estimator recovers the true cardinality.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
5
Empirical Studies
We evaluate TGCM under three complementary dataset regimes. First, we use a synthetic mixed-APT dataset to provide controlled supervision for training, sequence reconstruction, technique-level attribution, and Auto-𝐾 evaluation. In this setting, single-APT technique sequences are generated using SAGA and mixed via the proposed structure-aware forward process. Second, we evaluate on established benchmarks, including ATLAS, NODLINK, ProvCon, DARPA TC-E3, and DARPA TC-E5. For datasets containing single-campaign traces, we apply the same forward mixing process to construct controlled mixed inputs. DARPA TC-E5 is treated separately, as it already contains naturally interleaved multi-APT behavior and thus requires no synthetic mixing. Third, we evaluate on CAPTure, a CALDERA–Procmon endto-end mixed-APT dataset, where interleaving arises from real adversary execution, and technique sequences are extracted from upstream systems rather than a synthetic mixing operator. Together, these regimes evaluate TGCM under (i) controlled supervision, (ii) zero-shot transfer to established benchmarks, and (iii) realistic end-to-end deployment conditions.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Algorithm 1 High-level structure-aware forward mixing Require: Single-campaign technique sequences {𝑠 1 , . . . , 𝑠𝐾 }, mixing steps 𝑇 Ensure: Mixed states { (𝑥𝑡 , 𝑦𝑡 ) }𝑡𝑇=1 1: Construct a canonical sequence 𝑥 0 = 𝑠 1 ∥𝑠 2 ∥ · · · ∥𝑠𝐾 , and initialize 𝑦0,𝑖 = 𝑘 if 𝑦0,𝑖 is from 𝑠𝑘 . 2: for 𝑡 = 1, . . . ,𝑇 do 3: Select an interaction budget 𝑚𝑡 and a block size 𝑏𝑡 . Starting from (𝑥𝑡 −1 , 𝑦𝑡 −1 ), choose contiguous blocks from different 4: campaigns. Move or insert selected blocks across campaign boundaries to in5: crease interleaving. 6: Reject any move that changes the relative order of occurrences within the same campaign. 7: Output the resulting mixed sequence and source labels as (𝑥𝑡 , 𝑦𝑡 ). 8: end for
selecting all occurrences whose source label is 𝑘. The forward process enforces Π𝑘 (𝑥𝑡 , 𝑦𝑡 ) = 𝑠𝑘 ,
5.1
Structure-Aware Forward Mixing
The structure-aware forward mixing process is used to generate mixed technique sequences when naturally interleaved ground truth is unavailable. Given a set of single-APT technique sequences, a naive generator may randomly shuffle techniques across campaigns. Such a generator can produce superficial mixtures but it often breaks the temporal structure of each campaign and makes the resulting labels less meaningful for technique-level attribution. Instead, we define mixing at the granularity of ordered technique occurrences. Each APT campaign is treated as an ordered sequence, and each occurrence carries both its ATT&CK technique identity and its source-campaign label. The forward process interleaves campaigns by moving contiguous blocks across campaign boundaries while preserving three invariants: technique identities, occurrence-level source labels, and the within-campaign order of each latent campaign. These invariants are important because the same ATT&CK technique may appear in multiple campaigns; therefore, repeated techniques cannot be merged and must remain distinguishable at the occurrence level. Algorithm 1 summarizes the process. The canonical state 𝑥 0 is obtained by concatenating the selected campaigns. For example, consider the three campaigns shown in Figure 3. The canonical sequence is 𝑥 0 = [1, 2, 3, 4] ∥ [1, 2, 3] ∥ [1, 2, 3, 4, 5, 6], with corresponding source labels 𝑦0 = [1, 1, 1, 1] ∥ [2, 2, 2] ∥ [3, 3, 3, 3, 3, 3]. At each mixing step, the process increases cross-campaign overlap by relocating contiguous blocks. Early steps produce coarse interleaving (e.g., 𝑥𝑡 −1 in Figure 3) because they use larger blocks and fewer campaign interactions. Later steps produce finer interleaving because they use smaller blocks and more frequent interactions (e.g., 𝑥𝑇 in Figure 3). This creates a controlled trajectory from a clean concatenation to heavily interleaved mixed sequences. The key constraint is order preservation within each latent campaign. Let Π𝑘 (𝑥𝑡 , 𝑦𝑡 ) denote the ordered subsequence obtained by
∀𝑘 ∈ {1, . . . , 𝐾 }, ∀𝑡 ∈ {0, . . . ,𝑇 }.
Thus, the mixed observation may contain strong cross-campaign interleaving, but each latent campaign remains recoverable as an order-preserving subsequence. This gives TGCM supervised occurrence-level labels while avoiding naive mixtures that destroy campaign structure. Detailed schedules and operator definitions are provided in Appendix E. For supervised training, we sample a mixture cardinality 𝐾, draw 𝐾 single-APT sequences, and apply the forward process to generate mixed sequences at different interleaving levels. Pairs of mixed sequences generated from the same underlying campaigns are used for the consistency objective, while occurrence-level source labels supervise technique attribution. This provides aligned training signals for both reconstructing campaign-level subsequences and assigning each technique occurrence to its latent source. This process is applied only when naturally mixed data are unavailable. Datasets such as DARPA TC-E5 and CAPTure already contain naturally interleaved behaviors and are therefore evaluated directly without synthetic forward mixing.
5.2
Metrics
We evaluate both technique-wise attribution fidelity and global partition quality. Let 𝑁 denote the number of mixed sequences. For each sequence 𝑖 ∈ 1, . . . , 𝑁 of length 𝑛𝑖 , let 𝑦𝑖,𝑗 and 𝑦ˆ𝑖,𝑗 denote the ground-truth and predicted campaign labels, respectively, for technique 𝑗 ∈ 1, . . . , 𝑛𝑖 . We use A to denote the set of non-residual campaigns appearing in the evaluation set (i.e., excluding label 0 if a residual channel is used). Macro-averaged APT-wise technique accuracy. For a specific campaign 𝑎 ∈ A, we define its technique-level accuracy as follows. Í𝑁 Í Acctech (𝑎) =
𝑖=1
𝑗: 𝑦𝑖,𝑗 =𝑎 I 𝑦ˆ𝑖,𝑗 = 𝑦𝑖,𝑗
Í𝑁 Í 𝑖=1
𝑗: 𝑦𝑖,𝑗 =𝑎 1
(14)
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Figure 3: Forward mixing and single-step demixing in TGCM. A canonical sequence 𝑥 0 , formed by concatenating 𝐾 single-APT campaigns, is progressively transformed into mixed states 𝑥𝑡 via a structure-aware forward process. Given an observed mixed sequence with unknown mixing level, TGCM applies a consistency-based inverse mapping to recover the canonical clean sequence 𝑥ˆ0 and predict technique-level assignments 𝑦ˆ in a single step. The overall evaluation metric reported during training is the macroaveraged APT-wise technique accuracy: 1 ∑︁ Acctech (𝑎) (15) Acc = |A| 𝑎∈ A Fowlkes–Mallows Index (FMI). We use FMI and NMI to evaluate clustering consistency between predicted and ground-truth partitions. FMI measures pairwise agreement, while NMI captures shared information between clusterings. FMI measures agreement between predicted and ground-truth technique partitions induced by 𝑦ˆ and 𝑦 via pairwise precision and recall: √︂ TP TP FMI = · (16) TP + FP TP + FN where True Positive (TP)/False Positive (FP) and False Negative (FN) count technique pairs that are co-assigned or separated in 𝑦ˆ relative to 𝑦. FMI ranges from 0 to 1. Normalized Mutual Information (NMI). Normalized Mutual Information quantifies the amount of information shared between the predicted and ground-truth clusterings, normalized by their individual entropies: NMI(𝑈 , 𝑉 ) =
2 · 𝐼 (𝑈 ; 𝑉 ) 𝐻 (𝑈 ) + 𝐻 (𝑉 )
(17)
where 𝐼 (𝑈 ; 𝑉 ) is the mutual information between the predicted clustering 𝑈 and ground-truth 𝑉 , and 𝐻 (·) denotes entropy. NMI ranges from 0 (no mutual information) to 1 (perfect correlation). Macro Precision, Recall, and F1-Score. We treat the APT campaign assignment as a multi-class classification problem. For each APT campaign 𝑎 ∈ A, we compute precision (𝑃𝑎 ), recall (𝑅𝑎 ), and F1-score (𝐹 1𝑎 ) as follows: 𝑃𝑎 =
TP𝑎 , TP𝑎 + FP𝑎
𝑅𝑎 =
TP𝑎 , TP𝑎 + FN𝑎
𝐹 1𝑎 =
2 · 𝑃𝑎 · 𝑅𝑎 𝑃𝑎 + 𝑅𝑎
(18)
The macro-averaged metrics (Precision, Recall and F1) are then calculated by averaging over all APT campaigns: 1 ∑︁ 1 ∑︁ 1 ∑︁ 𝑃= 𝑃𝑎 , 𝑅 = 𝑅𝑎 , 𝐹 1 = 𝐹 1𝑎 (19) |A| |A| |A| 𝑘∈A
𝑘∈A
𝑘∈A
5.3
Baseline Comparisons
We compare TGCM against baselines in two categories: i) unsupervised pattern mining & Probabilistic models; and ii) deep latent disentanglement and general intelligence models. Table 2 compares their automation, efficiency, and effectiveness against the proposed TGCM. 5.3.1 Category I: Unsupervised Pattern Mining & Probabilistic Models. These methods rely on statistical co-occurrence or Markovian assumptions, and typically lack the ability to model long-range dependencies or semantic structure. • Smith-Waterman Alignment [62, 64]: Performs local sequence matching. While effective for motifs, its pairwise nature lacks the scalability and global context required for multi-source demixing compared to our TGCM approach. • Object-Centric Petri Nets (OCPN) [70]: Models interacting object flows. It enforces rigid logical constraints (𝐴 → 𝐵), failing to capture the fuzzy, probabilistic transitions of evolving APTs that TGCM handles. • Iterative Local Process Model (iLPM) [68]: Greedily extracts frequent patterns. It serves as a frequentist baseline but lacks the semantic generalization to detect rare or variant attack sequences. • Frequent Episode Mining (FEM) [21]: Identifies serial correlations within sliding windows, failing to capture the long-term dependencies inherent in prolonged APT campaigns. • TOA Difference Histogram [14, 74]: Separates sources based on time-of-arrival regularity. It fails to handle the nonperiodic, jittery timing of real-world APTs. • HMM & Factorial HMM [7, 22]: Classical generative models. Despite FHMM modeling concurrency, both are constrained by memoryless properties, missing the long-range tactical contexts that TGCM captures. • Uniform Random (UR): A chance-level baseline that assigns each non-padding technique an APT label uniformly at random from {1, . . . , 𝐾 }.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Table 2: Comparison of demixing approaches. Methods are evaluated along five dimensions: (1) Auto-𝐾: ability to infer the number of APT campaigns; (2) Seq.: modeling of sequential dependencies; (3) GPU: support for parallel batch processing; (4) Efficiency: computational complexity and scalability; (5) Effectiveness: ability to capture complex, non-linear, and long-range patterns. (•: Fully Supported/High, ◦: Partially Supported/Medium, −: Not Supported/Low) Category
Cat. I: Unsupervised
Group
Auto 𝐾
Seq.
GPU
Efficiency
Effectiveness
Smith-Waterman (SW) [62, 64] OCPN / iLPM [68, 70] Frequent Episode (FEM) [21] TOA Histograms [14, 74] HMM [7] Factorial HMM (FHMM) [22] Uniform Random (UR)
− ◦ − − − − −
• • ◦ ◦ ◦ ◦ −
• − − − ◦ ◦ •
Low (𝑂 (𝐿 2 )) Low (CPU-bound) Low (Combinatorial) High (𝑂 (𝑁 )) Medium (Iterative) Low (State Exp.) High (𝑂 (𝑁 ))
Medium (Local only) Low (Too rigid) Low (Window-limited) Low (Periodic only) Medium (Markovian) Medium (Concurrent) Low (Chance-level)
Group A: Deep
SepFormer [67] DANet [15] MossFormer2 [81]
− − −
• • •
• • •
High (GPU) High (GPU) High (Hybrid)
High (Global Seq.) High (Attractor) High
Group B: Statistical
DECOMPOSE [11] TD-DMD [53]
• −
− ◦
• •
Medium (Matrix Fac.) Medium (SVD)
Medium (No order) Medium (Linear)
Pattern Mining
Cat. II: Deep & Statistical
Proposed
Method
Group C: GenAI
LLMs (ChatGPT/Gemini/Grok)
•
•
•
Low (Latency)
High (Black-box)
Ours
TGCM
•
•
•
High (GPU)
High
Figure 4: Performance comparison of baselines and TGCM variants. Subplots show (top-left) Accuracy, (top-right) FMI, (bottomleft) NMI, and (bottom-right) F1. Bars are grouped by the number of campaigns 𝐾 ∈ {2, . . . , 6}. Methods to the right of the dashed line denote TGCM variants with different embedding backbones (ATTACK, CTI, CY, CYSec, Sec, Secure, MiniLM). Grok-4-NR and Grok-4-R indicate non-reasoning and reasoning settings, respectively; UR denotes Uniform Random.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
5.3.2 Category II: Deep Disentanglement & General Intelligence. We compare deep architectures and LLMs to justify the need for a specialized TGCM model. Group A: Deep Neural Sequence Models • SepFormer [67] & MossFormer2 [81]: SOTA Transformerbased architectures. They represent the upper bound of separation performance but suffer from high computational costs and low interpretability compared to our lightweight TGCM structure. • DANet (Deep Attractor Network) [15]: Uses attractor points for clustering. Our dynamic TGCM outperforms these static centers in sparse log environments. Group B: Algebraic Decomposition • DECOMPOSE (Probabilistic Blind Source Separation) [11]: A Bayesian "bag-of-techniques" model. By ignoring sequential order, it fails to preserve causal attack progression. • Time-Delayed DMD [53]: Extends Dynamic Mode Decomposition with delay embeddings. As a linear spectral method, it struggles with the highly non-linear branching of complex APT lifecycles. Group C: General Intelligence Baseline • LLMs (ChatGPT, Gemini, Grok): General-purpose incontext learners. While strong in zero-shot tasks, they are limited by high latency, opacity, and cost. We evaluate them as prompt-only zero-shot baselines, testing whether generalpurpose reasoning alone can replace a task-specific demixing model.
5.4
Metric-wise Comparison Across 𝐾
Figure 4 shows that TGCM consistently achieves the best Accuracy and F1 across all 𝐾 ∈ {2, . . . , 6}. Its performance degrades only mildly as 𝐾 increases, indicating strong robustness to crosscampaign interference. TGCM does not always dominate FMI and NMI, as some clustering-oriented baselines achieve competitive scores. This reflects differing evaluation emphasis: Accuracy/F1 measure technique-level attribution (our primary objective), whereas FMI/NMI focus on global partition consistency. A method may preserve coarse clustering while making local assignment errors, leading to higher FMI/NMI but lower attribution accuracy. For analyst-facing attribution, a locally wrong technique-to-campaign assignment is more damaging than a slightly different global partition; therefore, Acc/F1 are the primary security metrics.
5.5
Sensitivity and Ablation Analysis
We analyze TGCM from two complementary views: hyperparameter sensitivity and component-level contribution. Feature importance. We apply LIME [60] to estimate local contributions of major factors, including mixture cardinality 𝐾, sequence count 𝑁 , topic count 𝐾topic , embedding backbone, and the number of forward steps 𝑇 . Table 3 shows that 𝐾 is the dominant factor: larger mixtures increase cross-campaign interference and make occurrence-level attribution harder. Increasing 𝑁 and reducing 𝑇 provide smaller positive effects, while 𝐾topic and the embedding backbone have limited local influence.
Table 3: LIME explanation for the best-performing configuration. The contribution weight reflects each feature’s local importance. Feature
Weight
𝐾↓ 𝑁 ↑ 𝑇 ↓ 𝐾topic Sizes Embedding Methods
0.1323 0.0322 0.0249 0.00117 0.00104
Component ablation. Motivated by the strong sensitivity to 𝐾, we evaluate four variants across increasing mixture complexity: Base, +Topic, +Consistency, and TGCM (+Topic+Consistency). We report normalized gain, Accfinal − Accinit NormGain(%) = × 100. 1 − Accinit Table 4: Normalized gain across mixture complexity 𝐾. 𝐾
Topic+Consistency
Topic
Consistency
Base
2 4 6
18.9% 18.1% 15.0%
18.9% 17.7% 14.4%
16.5% 17.0% 13.5%
16.4% 16.8% 13.4%
As shown in Table 4, topic guidance and consistency learning are complementary: topic guidance improves semantic disambiguation under technique reuse, while consistency learning stabilizes the inverse mapping across different interleaving levels. Their combination achieves the best gain for all tested 𝐾 values. Based on the same training/evaluation protocol, we perform a factorial ablation over two components (topic modeling and the consistency objective) with four variants: (i) Base (neither), (ii) +Topic, (iii) +Consistency, and (iv) +Topic+Consistency (TGCM). Unless stated otherwise, all other hyper-parameters follow the default setting.
5.6
Zero-shot Evaluation on Benchmarks
We evaluate zero-shot generalization of TGCM on the benchmark datasets using a model trained solely on SAGA-generated synthetic APT campaigns. All benchmark datasets remain unseen during training. We map all benchmark campaigns to MITRE ATT&CK technique sequences. Technique coverage is summarized in Table 6, and the complete technique lists are provided in Appendix Table 10. We then compare TGCM against DANet [15], the strongest baseline in Figure 4. Forward-mixed zero-shot. For benchmark datasets that provide single-campaign traces, we use the forward mixing process only to create controlled multi-campaign test cases. The model is trained solely on SAGA-generated mixtures and is never fine-tuned on ATLAS [3], NODLINK [44], ProvCon [78], or DARPA TC-E3 [1]. For each supported 𝐾 ≤ 6, we report mean and standard deviation over 10 runs with 100 samples each. Table 5 shows that TGCM generally improves occurrence-level attribution over DANet under unseen campaign sources and increasing mixture complexity. In-the-wild interleaving (DARPA TC-E5). DARPA TC-E5 [36] differs from the forward-mixed benchmarks because the evaluated
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
sequences are naturally interleaved across multiple hosts and days; no synthetic mixing is applied at test time. The evaluated cases contain two or four campaigns with repeated technique reuse. We annotate technique-level campaign assignments from the TC-E5 documentation and evaluate TGCM directly on these mixed sequences. The results in Table 5 show that TGCM maintains stronger attribution accuracy than DANet under naturally interleaved behavior. Robustness to Increasing Mixture Cardinality. As shown in Table 5, TGCM demonstrates superior robustness as 𝐾 increases in all datasets. On ATLAS, topic guidance allows TGCM to effectively disambiguate reused early-stage prefixes, preserving campaignspecific cues where baselines falter. Similarly, on ProvCon, TGCM excels under mild interference (𝐾 = 2) and retains a strong lead in identifying correct assignments even as dependencies blur with higher 𝐾. Decision-Aligned Attribution vs. Clustering. Table 5 shows a consistent trade-off on NODLINK and DARPA TC-E3/E5. Baselines such as DANet achieve stronger internal cluster consistency in some cases, but often collapse overlapping segments, whereas TGCM yields higher decision-aligned attribution accuracy. This is especially evident on naturally interleaved DARPA TC-E5, where TGCM generalizes to different background activities without retraining and better distinguishes overlapping campaign segments.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
lower accuracy. Overall, TGCM offers the most reliable end-to-end attribution under noisy upstream outputs. Interpreting the Acc–F1 trade-off under unknown 𝐾. Table 7 evaluates a stricter unknown-𝐾 setting in which models decode under a fixed maximum budget while the true campaign count varies. Macro-F1 is sensitive to low-support or unused prediction slots, whereas accuracy directly measures occurrence-level attribution. This explains the divergence under TREC: DANet may achieve higher macro-F1 by producing more balanced clusters, but its lower accuracy indicates more misattributed techniques. TGCM instead prioritizes occurrence-level attribution, which is the primary objective for downstream threat analysis. Deployment and cardinality estimation. TGCM serves as a postdetection reasoning module that takes ATT&CK-level technique streams from upstream log-to-technique pipelines and separates interleaved techniques into campaign-consistent sequences. Beyond attribution, Table 7 reports cardinality estimation via MAE, measuring the gap between TGCM’s inferred 𝐾ˆ and the ground-truth 𝐾 in Equation 13. TGCM estimates 𝐾ˆ under the fixed budget 𝐾max = 6 without oracle cardinality, while DANet is not applicable because its K-means stage cannot infer the active number of campaigns and requires 𝐾ˆ to be specified externally.
6 5.7
End-to-End Evaluation on CAPTure with Unknown Mixture Cardinality
Our earlier evaluations assume access to the ground-truth mixture cardinality 𝐾, allowing TGCM and baseline methods to decode with the true number of constituent APTs. While this oracle setting enables controlled analysis, it is unrealistic in deployment. In practice, defenders observe only raw audit logs and do not know how many campaigns are interleaved. Moreover, they rely on noisy technique sequences produced by upstream log-to-technique systems such as SFM [32], ZOOMER [58], and TREC [48]. To evaluate under this realistic setting, we construct CAPTure, a CALDERA-collected mixed-APT audit dataset with mixture sizes ranging from 𝐾 = 2 to 𝐾 = 6 (20 audit logs per 𝐾). To our knowledge, no publicly available audit-log benchmark supports end-to-end mixed-APT demixing under these conditions. Details of data collection and labeling are provided in Appendix G. For each audit log, we apply SFM, ZOOMER, and TREC to obtain three technique sequences, which are then used as inputs to TGCM and DANet for downstream demixing. During inference, the true campaign count is not provided; both models decode under a fixed maximum budget of 𝐾max = 6. Table 7 shows that TGCM achieves higher accuracy than DANet across all upstream systems and mixture sizes, confirming its advantage in realistic unknown-𝐾 end-to-end settings. Performance drops as 𝐾 increases, due to stronger interleaving, technique reuse, and upstream errors. TREC yields the best downstream accuracy, especially with TGCM, suggesting that better technique extraction improves campaign recoverability. F1 shows a nuanced trade-off: TGCM is generally stronger under SFM/ZOOMER noise, while DANet sometimes attains higher F1 under TREC at larger 𝐾 despite
Related Work
Our problem lies at the intersection of attack investigation, process mining, blind source separation, and generative modeling. We summarize the most relevant threads and clarify why they do not resolve interleaved APT technique decomposition, motivating TGCM. Attack investigation and process mining. Provenance-based systems [3, 28, 31] and ATT&CK-oriented pipelines [37, 46, 48, 77] typically operate on raw audit events or provenance graphs, using causal dependencies, expert rules, or supervised learning to detect suspicious behaviors and abstract them into higher-level attack evidence. Event-case correlation (ECC) in process mining similarly assigns events to latent cases when identifiers are missing [8, 9, 57], but usually relies on explicit process models or attribute constraints [47, 56]. In contrast, TGCM addresses a different downstream problem: after an upstream module has already converted enterprise telemetry into a time-ordered MITRE ATT&CK technique sequence, multiple campaigns may still remain temporally interleaved, share techniques, and lack explicit campaign boundaries. Our goal is therefore not to replace provenance-based detection, but to disentangle mixed symbolic technique streams under unknown mixture cardinality 𝐾 and attribution ambiguity. In this sense, provenance-based methods and TGCM are complementary: the former recovers attack evidence from raw telemetry, whereas the latter separates concurrent campaigns after symbolic abstraction, when raw system identifiers and causal graph structure are no longer available. TGCM resolves this downstream ambiguity by combining sequence context with soft semantic priors derived from FASTopic [73]. Blind source separation (BSS) Classical BSS [39] methods (e.g., ICA, NMF) decompose mixtures under independence or linearity assumptions [34, 42], which do not hold for discrete, order-sensitive technique interleavings. Radar de-interleaving focuses on timing separation [14] but lacks the semantic dimension necessary for APT
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Table 5: Zero-shot performance across five benchmark datasets. TGCM is compared with the strongest baseline, DANet, across varying numbers of concurrent campaigns (𝐾 = 2–6). K=2 Dataset
Model
Acc ↑
K=3 F1 ↑
Acc ↑
K=4 F1 ↑
Acc ↑
K=5
K=6
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Forward-mixing zero-shot ATLAS
TGCM DANet
0.4230.034 0.4090.017
0.5700.023 0.3380.018
0.4010.031 0.2880.010
0.3150.014 0.2250.009
0.3430.029 0.2830.004
0.2110.008 0.1900.003
N/A N/A
N/A N/A
N/A N/A
N/A N/A
NODLINK
TGCM DANet
0.3320.035 0.4780.010
0.5560.023 0.3950.012
0.4240.040 0.3390.007
0.2630.013 0.2390.004
N/A N/A
N/A N/A
N/A N/A
N/A N/A
N/A N/A
N/A N/A
ProvCon
TGCM DANet
0.7220.021 0.3420.030
0.5490.026 0.2790.028
0.7060.013 0.2740.014
0.2380.008 0.2100.013
0.7020.023 0.2340.014
0.1080.004 0.1610.010
0.6780.019 0.1880.012
0.1110.009 0.1140.005
0.7320.014 0.1510.005
0.0880.004 0.0810.003
DARPA TC-E3
TGCM DANet
0.4600.038 0.4610.026
0.5280.035 0.4010.025
0.3920.039 0.3370.022
0.2840.016 0.2530.014
0.4380.035 0.2640.023
0.1850.008 0.1770.013
0.4120.048 0.1950.017
0.1200.009 0.1200.007
0.4130.026 0.1570.013
0.0830.007 0.0850.005
DARPA TC-E5
TGCM DANet
0.8660.027 0.5660.159
0.5530.020 0.5350.156
N/A N/A
N/A N/A
N/A N/A
N/A N/A
In-the-wild interleaved zero-shot N/A N/A
0.6990.057 0.4500.079
N/A N/A
0.4520.045 0.3790.070
↑ indicates that a higher value is better. N/A indicates that the dataset does not support the corresponding setting. Table 6: Kill-chain coverage of zero-shot evaluation datasets, measured by the number of unique techniques mapped to each phase. Dataset ATLAS NODLINK ProvCon DARPA TC-E3 DARPA TC-E5
Init. Access 0 0 1 2 1
Execution 3 1 0 6 4
Persistence 1 0 1 3 1
Def. Evasion 3 0 0 1 3
Cred. Access 0 0 1 2 2
Discovery 1 9 1 9 9
Collection 0 1 0 1 2
C2 2 1 1 3 4
Exfiltration 0 0 0 1 2
Table 7: End-to-end evaluation on CAPTure with unknown mixture cardinality 𝐾. Audit logs are first mapped to technique sequences by upstream systems (SFM, ZOOMER, TREC), followed by demixing using TGCM and DANet. The true campaign count is not provided; both models decode with a fixed maximum budget 𝐾max = 6, while ground-truth 𝐾 ∈ [2, 6]. Extractor
Model
Acc ↑
K=2 F1 ↑
MAE ↓
Acc ↑
K=3 F1 ↑
MAE ↓
Acc ↑
K=4 F1 ↑
MAE ↓
Acc ↑
K=5 F1 ↑
MAE ↓
Acc ↑
K=6 F1 ↑
MAE ↓
SFM
TGCM DANet
0.8330.034 0.2080.024
0.3740.023 0.0910.009
0.5350.071 N/A
0.7230.045 0.1900.015
0.2440.015 0.1060.008
0.8200.127 N/A
0.5500.053 0.1950.020
0.2040.010 0.1260.012
1.3650.081 N/A
0.4600.050 0.1710.013
0.1460.012 0.1300.010
1.5890.115 N/A
0.4290.063 0.1590.022
0.1470.013 0.1360.017
2.1640.140 N/A
Zoomer
TGCM DANet
0.6210.044 0.2210.030
0.4510.023 0.0980.014
0.1250.056 N/A
0.4670.069 0.2050.018
0.2750.014 0.1130.009
0.6700.075 N/A
0.3710.076 0.1840.014
0.2060.007 0.1210.012
0.8950.082 N/A
0.4570.076 0.1800.015
0.1660.010 0.1350.015
1.5650.166 N/A
0.4350.068 0.1630.010
0.1280.008 0.1390.009
1.7050.162 N/A
TREC
TGCM DANet
0.8660.016 0.2050.026
0.3880.017 0.0930.011
0.6000.087 N/A
0.5430.039 0.1780.026
0.2320.011 0.1050.015
1.1450.035 N/A
0.4160.046 0.1700.017
0.1640.008 0.1190.011
1.8450.082 N/A
0.4760.063 0.1800.017
0.1290.012 0.1350.011
2.1100.099 N/A
0.4050.073 0.1590.013
0.1190.009 0.1440.015
2.6950.096 N/A
Í ↑ indicates that a higher value is better, and ↓ indicates that a lower value is better. MAE is the trace-level cardinality error 𝑁1 𝑖 |𝐾ˆ𝑖 − 𝐾𝑖 |; ˆ DANet is marked N/A because its K-means stage requires a predefined cluster number and does not infer 𝐾. techniques. TGCM addresses this non-additive, semantic interleaving setting by injecting structural and semantic inductive biases rather than relying on statistical independence. Diffusion/consistency models and semantic priors. Diffusion models [5, 45] and Consistency Models [65] provide principled denoising frameworks, but standard usage targets single-source corruption and iterative sampling. TGCM instead treats interleaving as a forward corruption process and leverages a consistency objective for single-step inverse mapping. In addition, whereas topic models (LDA/BERTopic/FASTopic) [10, 25, 73] are often used as static features, TGCM integrates topics as a dynamic semantic prior
to disambiguate shared techniques and encourage coherent killchain progressions. Relation to conversation disentanglement. Thread disentanglement in NLP also separates interleaved sources [40, 63], but typically outputs clusters/graphs rather than reconstructing canonical, order-preserving technique sequences required for campaign analysis.
7
Conclusion
We study the Unknown-K Interleaved Sequence Demixing (UKISD) problem, which aims to recover latent APT campaigns from
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
interleaved ATT&CK-level technique sequences under overlapping execution, shared techniques, and unknown mixture cardinality 𝐾. To address this challenge, we propose Topic-Guided Consistency Modeling (TGCM), a generative framework that formulates mixed-APT analysis as semantic sequence disentanglement rather than multi-label classification. By integrating topic-guided semantic priors with a consistency-based one-step inference model, TGCM recovers coherent campaign-level technique chains while maintaining efficient and scalable inference. Extensive experiments on synthetic mixtures, benchmark datasets, DARPA traces, and the CAPTure dataset demonstrate that TGCM consistently improves occurrence-level attribution under heavy interleaving, technique reuse, upstream noise, and unknown 𝐾. These results position TGCM as a lightweight post-abstraction reasoning module that is both compatible with and complementary to existing log-to-technique pipelines. Future work includes joint extraction–demixing modeling and extending TGCM to open-vocabulary settings.
References [1] A. D. Keromytis. Transparent computing engagement 3 data release. https://gith ub.com/darpa-i2o/Transparent-Computing/blob/master/README-E3.md, 2018. [2] Dmitri Alperovitch. Bears in the midst: Intrusion into the democratic national committee. CrowdStrike Blog (From the Front Lines), June 2016. Published June 14, 2016. Accessed: 2025-12-23. [3] Abdulellah Alsaheel, Yuhong Nan, Shiqing Ma, Le Yu, Gregory Walkup, Z Berkay Celik, Xiangyu Zhang, and Dongyan Xu. { ATLAS } : A sequence-based learning approach for attack investigation. In 30th USENIX security symposium (USENIX security 21), pages 3005–3022, 2021. [4] Enes Altinisik, Fatih Deniz, and Hüsrev Taha Sencar. Provg-searcher: A graph representation learning approach for efficient provenance graph search. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023. [5] Jacob Austin, Daniel D Johnson, Jonathan Ho, Daniel Tarlow, and Rianne Van Den Berg. Structured denoising diffusion models in discrete state-spaces. Advances in neural information processing systems, 34:17981–17993, 2021. [6] Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint arXiv:1607.06450, 2016. [7] Leonard E Baum, Ted Petrie, George Soules, and Norman Weiss. A maximization technique occurring in the statistical analysis of probabilistic functions of markov chains. The annals of mathematical statistics, 41(1):164–171, 1970. [8] Dina Bayomie, Claudio Di Ciccio, Marcello La Rosa, and Jan Mendling. A probabilistic approach to event-case correlation for process mining. In International Conference on Conceptual Modeling, pages 136–152. Springer, 2019. [9] Dina Bayomie, Claudio Di Ciccio, and Jan Mendling. Event-case correlation for process mining using probabilistic optimization. Information Systems, 114:102167, 2023. [10] David M Blei, Andrew Y Ng, and Michael I Jordan. Latent dirichlet allocation. Journal of machine Learning research, 3(Jan):993–1022, 2003. [11] Alexander Böttcher, Wieland Brendel, Bernhard Englitz, and Matthias Bethge. Trace your sources in large-scale data: one ring to find them all. arXiv preprint arXiv:1803.08882, 2018. [12] Laurent Bulteau and Stéphane Vialette. Recognizing binary shuffle squares is np-hard. Theoretical Computer Science, 806:116–132, 2020. [13] Sam Buss and Michael Soltys. Unshuffling a square is np-hard. Journal of Computer and System Sciences, 80(4):766–776, 2014. [14] Rouxuan Chen, Jibin Zheng, Chenrui Li, Liangtian Wan, and Hongwei Liu. Radar signal deinterleaving with multi-feature semantics and modular network design. IEEE Transactions on Aerospace and Electronic Systems, 2025. [15] Zhuo Chen, Yi Luo, and Nima Mesgarani. Deep attractor network for singlemicrophone speaker separation. In Acoustics, Speech and Signal Processing (ICASSP), 2017 IEEE International Conference on, pages 246–250. IEEE, 2017. [16] Zijun Cheng, Qiujian Lv, Jinyuan Liang, Yan Wang, Degang Sun, Thomas Pasquier, and Xueyuan Han. Kairos: Practical intrusion detection and investigation using whole-system provenance. In 2024 IEEE Symposium on Security and Privacy (SP), pages 3533–3551. IEEE, 2024. [17] Microsoft DART. https://www.microsoft.com/security/blog/then-there-were-six. Accessed: 2025-08-13. [18] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780–8794, 2021.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
[19] Hailun Ding, Juan Zhai, Yuhong Nan, and Shiqing Ma. { AIRTAG } : Towards automated attack investigation by unsupervised learning with log texts. In 32nd USENIX Security Symposium (USENIX Security), 2023. [20] Min Du, Feifei Li, Guineng Zheng, and Vivek Srikumar. Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 1285–1298, 2017. [21] Philippe Fournier-Viger, M Saqib Nawaz, Yulin He, Youxi Wu, Farid Nouioua, and Unil Yun. Maxfem: Mining maximal frequent episodes in complex event sequences. In International Conference on Multi-disciplinary Trends in Artificial Intelligence, pages 86–98. Springer, 2022. [22] Zoubin Ghahramani and Michael Jordan. Factorial hidden markov models. Advances in neural information processing systems, 8, 1995. [23] Anushreya Ghosh, Annan Dong, Alexander Haimovich, Osvaldo Simeone, and Jason Dabin. Blind source separation of intermittent frequency hopping sources over los and nlos channels. Entropy, 25(9):1292, 2023. [24] Akul Goyal, Xueyuan Han, Gang Wang, and Adam Bates. Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems. In 30th Network and Distributed System Security Symposium, 2023. [25] Maarten Grootendorst. Bertopic: Neural topic modeling with a class-based tf-idf procedure. arXiv preprint arXiv:2203.05794, 2022. [26] Haixuan Guo, Shuhan Yuan, and Xintao Wu. Logbert: Log anomaly detection via bert. In 2021 international joint conference on neural networks (IJCNN), pages 1–8. IEEE, 2021. [27] Xueyuan Han, Thomas Pasquier, Adam Bates, James Mickens, and Margo Seltzer. Unicorn: Runtime provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525, 2020. [28] Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. Nodoze: Combatting threat alert fatigue with automated provenance triage. In network and distributed systems security symposium, 2019. [29] Wajih Ul Hassan, Mohammad Ali Noureddine, Pubali Datta, and Adam Bates. Omegalog: High-fidelity attack investigation via transparent multi-layer log analysis. In Network and distributed system security symposium, 2020. [30] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. [31] Md Nahid Hossain, Sadegh M Milajerdi, Junao Wang, Birhanu Eshete, Rigel Gjomemo, R Sekar, Scott Stoller, and VN Venkatakrishnan. { SLEUTH } : Realtime attack scenario reconstruction from { COTS } audit data. In 26th USENIX Security Symposium (USENIX Security 17), pages 487–504, 2017. [32] Yi-Ting Huang, Ying-Ren Guo, Guo-Wei Wong, and Meng Chang Chen. A cascade approach for apt campaign attribution in system event logs: Technique hunting and subgraph matching. In ICC 2025-IEEE International Conference on Communications, pages 1073–1078. IEEE, 2025. [33] Yi-Ting Huang, Ying-Ren Guo, Yu-Sheng Yang, Guo-Wei Wong, Yu-Zih Jheng, Yeali Sun, Jessemyn Modini, Timothy Lynar, and Meng Chang Chen. Saga: Synthetic audit log generation for apt campaigns. IEEE Transactions on Dependable and Secure Computing, pages 1–16, 2025. [34] Aapo Hyvärinen and Erkki Oja. Independent component analysis: algorithms and applications. Neural networks, 13(4-5):411–430, 2000. [35] jackaduma. SecBERT: A pretrained language model for cyber security text. https://github.com/jackaduma/SecBERT, 2022. Accessed: 2026-04-30. [36] Jacob Torrey. Transparent computing engagement 5 data release. https://github .com/darpa-i2o/Transparent-Computing/blob/master/README.md, 2020. [37] Zian Jia, Yun Xiong, Yuhong Nan, Yao Zhang, Jinjing Zhao, and Mi Wen. { MAGIC } : Detecting advanced persistent threats via masked graph representation learning. In 33rd USENIX Security Symposium (USENIX Security 24), pages 5197–5214, 2024. [38] Yuning Jiang, Qiaoran Meng, Feiyang Shang, Nay Oo, Le Thi Hong Minh, Hoon Wei Lim, and Biplab Sikdar. Mitre att&ck applications in cybersecurity and the way forward. arXiv preprint arXiv:2502.10825, 2025. [39] Christian Jutten and Jeanny Herault. Blind separation of sources, part i: An adaptive algorithm based on neuromimetic architecture. Signal processing, 24(1):1– 10, 1991. [40] Jonathan K Kummerfeld, Sai R Gouravajhala, Joseph J Peper, Vignesh Athreya, Chulaka Gunasekara, Jatin Ganhotra, Siva Sankalp Patel, Lazaros C Polymenakos, and Walter Lasecki. A large-scale corpus for conversation disentanglement. In Proceedings of the 57th annual meeting of the association for computational linguistics, pages 3846–3856, 2019. [41] Yonghwi Kwon, Fei Wang, Weihang Wang, Kyu Hyung Lee, Wen-Chuan Lee, Shiqing Ma, Xiangyu Zhang, Dongyan Xu, Somesh Jha, Gabriela Ciocarlie, et al. Mci: Modeling-based causality inference in audit logging for attack investigation. In Network and Distributed Systems Security (NDSS) Symposium, 2018. [42] Daniel D Lee and H Sebastian Seung. Learning the parts of objects by nonnegative matrix factorization. nature, 401(6755):788–791, 1999. [43] Insup Lee and Changhee Choi. Camp2vec: Embedding cyber campaign with att&ck framework for attack group analysis. ICT Express, 9(6):1065–1070, 2023.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
[44] Shaofei Li, Feng Dong, Xusheng Xiao, Haoyu Wang, Fei Shao, Jiedong Chen, Yao Guo, Xiangqun Chen, and Ding Li. Nodlink: An online system for fine-grained apt attack detection and investigation. In Proceedings 2024 Network and Distributed System Security Symposium, NDSS 2024. Internet Society, 2024. [45] Xiang Li, John Thickstun, Ishaan Gulrajani, Percy S Liang, and Tatsunori B Hashimoto. Diffusion-lm improves controllable text generation. Advances in neural information processing systems, 35:4328–4343, 2022. [46] Zhenyuan Li, Jun Zeng, Yan Chen, and Zhenkai Liang. Attackg: Constructing technique knowledge graph from cyber threat intelligence reports. In European Symposium on Research in Computer Security, pages 589–609. Springer, 2022. [47] Tom Lichtenstein, Dorina Bano, and Mathias Weske. Attribute-driven case notion discovery for unlabeled event logs. In International Conference on Business Process Management, pages 111–122. Springer, 2021. [48] Mingqi Lv, HongZhe Gao, Xuebo Qiu, Tieming Chen, Tiantian Zhu, Jinyin Chen, and Shouling Ji. Trec: Apt tactic/technique recognition via few-shot provenance subgraph learning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 139–152, 2024. [49] Microsoft. Process Monitor v4.01. https://learn.microsoft.com/en-us/sysinternal s/downloads/procmon. Accessed: 2025-08-06. [50] Sadegh M Milajerdi, Birhanu Eshete, Rigel Gjomemo, and VN Venkatakrishnan. Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 1795–1812, 2019. [51] Sadegh M Milajerdi, Rigel Gjomemo, Birhanu Eshete, Ramachandran Sekar, and VN Venkatakrishnan. Holmes: real-time apt detection through correlation of suspicious information flows. In 2019 IEEE symposium on security and privacy (SP), pages 1137–1152. IEEE, 2019. [52] MITRE. MITRE CALDERA: Automated adversary emulation platform. https: //github.com/mitre/caldera. Accessed: 2026-04-19. [53] Gyurhan Nedzhibov. Blind source separation using time-delayed dynamic mode decomposition. Computation, 13(2), 2025. [54] Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International conference on machine learning, pages 8162–8171. PMLR, 2021. [55] Youngja Park and Weiqiu You. A pretrained language model for cyber threat intelligence. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: Industry Track, pages 113–122, 2023. [56] Marco Pegoraro, Merih Seran Uysal, Tom-Hendrik Hülsmann, and Wil MP van der Aalst. Resolving uncertain case identifiers in interaction logs: A user study. arXiv preprint arXiv:2212.00009, 2022. [57] Shaya Pourmirza, Remco Dijkman, and Paul Grefen. Correlation miner: mining business process models and event correlations without case identifiers. International Journal of Cooperative Information Systems, 26(02):1742002, 2017. [58] Xuebo Qiu, Mingqi Lv, Tieming Chen, Tiantian Zhu, Qijie Song, and Zhiling Zhu. Zoomer: An apt ttp recognition system via deep & wide provenance graph learning. IEEE Transactions on Dependable and Secure Computing, 2025. [59] Priyanka Ranade, Aritran Piplai, Anupam Joshi, and Tim Finin. Cybert: Contextualized embeddings for the cybersecurity domain. In 2021 IEEE International Conference on Big Data (Big Data), pages 3334–3342, 2021. [60] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. " why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135–1144, 2016. [61] A. Saha, J. Mattei, J. Blasco, L. Cavallaro, D. Votipka, and M. Lindorfer. Expert insights into advanced persistent threats: Analysis, challenges, and practitioner perspectives. In USENIX Security, 2024. [62] Bertil Schmidt, Felix Kallenborn, Alejandro Chacon, and Christian Hundt. Cudasw++ 4.0: ultra-fast gpu-based smith–waterman protein sequence database search. BMC bioinformatics, 25(1):342, 2024. [63] Dou Shen, Qiang Yang, Jian-Tao Sun, and Zheng Chen. Thread detection in dynamic text message streams. In Proceedings of the 29th annual international ACM SIGIR conference on Research and development in information retrieval, pages 35–42, 2006. [64] Temple F Smith, Michael S Waterman, et al. Identification of common molecular subsequences. Journal of molecular biology, 147(1):195–197, 1981. [65] Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. ICML, 2023. [66] Blake Strom, Andy Applebaum, Doug Miller, Kathryn Nickels, Adam Pennington, and Cody Thomas. MITRE ATT&CK: Design and philosophy. https://www.mitr e.org/sites/default/files/publications/pr-18-0944-11-mitre-attack-design-andphilosophy.pdf, 2018. [67] Cem Subakan, Mirco Ravanelli, Samuele Cornell, Mirko Bronzi, and Jianyuan Zhong. Attention is all you need in speech separation. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 21–25. IEEE, 2021. [68] Niek Tax, Natalia Sidorova, Reinder Haakma, and Wil M P van der Aalst. Mining local process models. Journal of Intelligent Information Systems, 47(2):183–222, 2016.
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
[69] Unit 42. Microsoft exchange server attack timeline: Discoveries and mitigations, March 2021. Published March 11, 2021. Accessed: 2025-12-23. [70] Wil MP van der Aalst. Object-centric process mining: unraveling the fabric of real processes. Mathematics, 11(12):2691, 2023. [71] Wil MP van der Aalst and Alessandro Berti. Discovering object-centric petri nets. Fundamenta informaticae, 175(1-4):1–40, 2020. [72] VMware. Fusion and Workstation. https://www.vmware.com/products/desktophypervisor/workstation-and-fusion. Accessed: 2026-04-21. [73] Xiaobao Wu, Thong Nguyen, Delvin Zhang, William Yang Wang, and Anh Tuan Luu. Fastopic: Pretrained transformer is a fast, adaptive, stable, and transferable topic model. Advances in Neural Information Processing Systems, 37:84447–84481, 2024. [74] Min Xie, Chuang Zhao, Yongjun Zhao, Dexiu Hu, and Zewen Wang. A novel method for deinterleaving radar signals: First-order difference curve based on sorted toa difference sequence. IET Signal Processing, 17(1):e12162, 2023. [75] Chunlin Xiong, Tiantian Zhu, Weihao Dong, Linqi Ruan, Runqing Yang, Yueqiang Cheng, Yan Chen, Shuai Cheng, and Xutong Chen. Conan: A practical real-time apt detection system with high accuracy and efficiency. IEEE Transactions on Dependable and Secure Computing, 19(1):551–565, 2020. [76] Jingjing Xu, Xu Sun, Zhiyuan Zhang, Guangxiang Zhao, and Junyang Lin. Understanding and improving layer normalization. Advances in neural information processing systems, 32, 2019. [77] Fengyu Yang, Yanni Han, Ying Ding, Qian Tan, and Zhen Xu. A flexible approach for cyber threat hunting based on kernel audit records. Cybersecurity, 5(1):11, 2022. [78] Anis Yusof, Shaofei Li, Arshdeep Singh Kawatra, Ding Li, Ee-Chien Chang, and Zhenkai Liang. From Observations to Insights: Constructing Effective Cyberattack Provenance With ProvCon. In Workshop on SOC Operations and Construction (WOSOC) 2025, 2025. [79] Syed Zaidi, Linda Smith, and Rajat Wason. LockBit, Hive, and BlackCat attack automotive supplier in triple ransomware attack. Sophos News, August 2022. [80] Jun Zeng, Zheng Leong Chua, Yinfang Chen, Kaihang Ji, Zhenkai Liang, and Jian Mao. Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics. In NDSS, 2021. [81] Shengkui Zhao, Yukun Ma, Chongjia Ni, Chong Zhang, Hao Wang, Trung Hieu Nguyen, Kun Zhou, Jia Qi Yip, Dianwen Ng, and Bin Ma. Mossformer2: Combining transformer and rnn-free recurrent network for enhanced time-domain monaural speech separation. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 10356–10360. IEEE, 2024.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
Ethical Considerations Overview and ethical approach. This work studies a defensive problem: decomposing in-the-wild interleaved sequences of MITRE ATT&CK techniques, derived from audit-log or provenance-based evidence, into multiple latent campaign sequences. The goal is to support incident responders in reasoning about concurrent or overlapping intrusions, not to enable intrusion, evasion, or attribution without human review. We structure this analysis around stakeholder impact, data governance, dual-use risk, reproducibility, and responsible deployment, following common ethical principles in computer-security research, including Beneficence, Respect for Persons, Justice, and Respect for Law and Public Interest. Stakeholders and potential impacts. (i) Defenders and incident responders. Benefits: The proposed method can help analysts separate overlapping campaign activity, reduce manual triage effort, and support more timely containment when multiple attack traces are interleaved. Risks: Model outputs may be over-trusted in highstakes settings, such as attribution, employee investigation, or incident reporting, even though upstream detection errors and model uncertainty may remain. (ii) System owners and end users represented in telemetry. Benefits: Improved campaign separation can help organizations detect and respond to intrusions more effectively, reducing downtime and downstream harm. Risks: Audit logs, process traces, and provenance data may contain sensitive identifiers, such as usernames, hostnames, file paths, command-line arguments, timestamps, or organizational structure. Improper handling or redistribution may conflict with user privacy expectations. (iii) Organizations that deploy monitoring infrastructure. Benefits: The work can improve post-incident reasoning under realistic monitoring conditions where evidence is noisy, incomplete, and mixed across campaigns. Risks: Weak governance around telemetry storage, access control, or secondary use could expose sensitive operational details. (iv) Dataset and tool providers. Benefits: Public datasets, attackemulation frameworks, and reproducibility artifacts enable transparent comparison and scientific progress. Risks: Mischaracterizing dataset scope, violating redistribution terms, or exposing nonanonymized artifacts could harm dataset providers and downstream users. (v) The research community and society. Benefits: A reproducible benchmark for mixed-campaign reasoning can help the community evaluate whether models remain reliable beyond clean singlecampaign assumptions. Risks: Public discussion of interleaving and demixing may shift attacker–defender dynamics if adversaries attempt to design behaviors that intentionally confuse campaign separation. (vi) Potential adversaries. Adversaries could study the assumptions of demixing systems and attempt to increase ambiguity in telemetry, for example by reusing common techniques, injecting irrelevant events, or mimicking multiple campaign styles. CAPTure data collection and controlled testbed. CAPTure is designed as a controlled research artifact for evaluating mixed APT reasoning under end-to-end telemetry-derived settings. The traces are generated in an isolated experimental environment rather than
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
collected from production users or enterprise systems. Attack behaviors are executed through controlled CALDERA operations, and host-level activity is recorded through Procmon in a test VM. This design reduces privacy risk because the data do not originate from real employee activity, customer environments, or live organizational infrastructure. CAPTure nevertheless contains host-level audit evidence and therefore requires careful handling. Even in a controlled VM, Procmonstyle logs may include local usernames, hostnames, directory paths, process names, command-line fragments, timestamps, and toolspecific metadata. Before release, the artifact should avoid exposing unnecessary identifiers, local account names, host-specific paths, credentials, authentication material, private network information, or author-identifying metadata. The released data should be limited to what is needed to reproduce the evaluation, such as techniquelevel sequences, campaign labels, sanitized event-derived features, labeling rules, and evaluation scripts. CAPTure labeling and annotation risk. CAPTure uses rulebased labeling to map observed CALDERA/Procmon evidence to ATT&CK technique occurrences. This labeling process is intended for defensive evaluation, but it may still introduce risks. First, labeling rules may contain assumptions about process names, paths, or behavior patterns that do not generalize to all environments. Second, incorrect labels may affect reported model performance. Third, releasing overly detailed detection logic may reveal how a particular experimental trace was identified. To mitigate these risks, CAPTure should present labels as research annotations rather than ground truth for all real deployments. The paper should clearly distinguish between controlledemulation labels, public-dataset annotations, and upstream-predicted technique sequences. Any released rules should be sanitized and framed as reproducibility material for the benchmark, not as complete production-grade detection content. Research procedures, data use, and compliance. All experiments are conducted offline on public research datasets, synthetic mixtures, controlled CAPTure traces, or technique-level abstractions derived from upstream systems. The core model operates on ATT&CK-level technique sequences rather than raw event payloads. This reduces exposure to personally identifying information and sensitive operational details. We do not attempt to re-identify individuals, organizations, hosts, or users. For public datasets, we follow their applicable access, citation, and redistribution requirements. For CAPTure, we release only the artifacts needed for reproducibility and avoid including unnecessary sensitive or author-identifying information. Potential harms. Privacy and consent. Audit logs and provenance traces can contain sensitive information even when collected for security purposes. Although CAPTure is generated in a controlled environment, public or proprietary telemetry used in future deployments may involve real users whose activities were not collected for research reuse. Operational misuse. Incorrect demixing outputs could waste analyst effort, delay containment, or support erroneous conclusions if used without corroborating evidence. The system should not be used as the sole basis for attribution, disciplinary action, legal claims, or public incident disclosure.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Dual-use. The work may help defenders reason about interleaved attack behavior, but it may also help adversaries understand how defenders separate mixed campaigns. CAPTure also relies on attackemulation tooling, which is dual-use by nature. The paper therefore avoids providing exploit instructions, live-target procedures, credentials, persistence guidance, or evasion playbooks. Benchmark overfitting. A public mixed-campaign benchmark may encourage models that overfit to specific emulation patterns, CALDERA ability coverage, or labeling rules. We mitigate this by evaluating across multiple datasets and by explicitly describing the scope and limitations of CAPTure. Mitigations and remaining risk. Data minimization. We emphasize technique-level abstractions and avoid releasing unnecessary raw identifiable telemetry. For CAPTure, the artifact should prioritize sanitized technique sequences, labels, evaluation scripts, and rule files required to reproduce the reported results. Controlled release. The artifact excludes credentials, private network details, real victim information, and operationally dangerous instructions. If event-level CAPTure files are included, they should be generated only from the controlled testbed and sanitized to remove author-identifying or environment-specific metadata. Non-operational reporting. We report methods and results at the level needed for scientific evaluation. We do not provide step-bystep intrusion instructions, exploit development details, or guidance for bypassing monitoring systems. Responsible interpretation. TGCM should be used as a decisionsupport tool. Its outputs should be reviewed by analysts, interpreted with uncertainty, and validated using independent evidence such as provenance context, host investigation, alerts, or threat-intelligence reports. Transparency about limitations. We explicitly identify the distinction between controlled CAPTure traces, synthetic structure-aware mixtures, public benchmark data, and upstream-predicted technique sequences. This prevents readers from interpreting controlledemulation results as a complete substitute for production deployment validation. Residual risk. Privacy and dual-use risks cannot be fully eliminated. They are reduced by using controlled data generation, techniquelevel abstractions, artifact minimization, and responsible framing, but future applications to sensitive production telemetry still require local review, access control, redaction, and human oversight. Ethics decision. We proceeded with this research because it addresses an important defensive gap: realistic security telemetry may contain concurrent, overlapping, or interleaved campaign evidence, yet existing evaluations often assume clean single-campaign inputs. The expected benefit is improved analyst support under mixed-campaign conditions. We judge that these benefits outweigh the remaining risks under the mitigations above, especially because the core evaluation can be conducted using public datasets, synthetic mixtures, and controlled CAPTure traces rather than private production logs. Artifact-release intent. To support reproducibility while protecting sensitive information, we provide an anonymous artifact for review and plan to release the reproducibility package publicly upon acceptance. The artifact is scoped to reproduce the paper’s main evaluation results and may include source code, inference scripts, evaluation scripts, sanitized CAPTure materials, labeling
rules, and data-organization utilities. The release excludes private telemetry, credentials, real victim information, author-identifying metadata, and operational details unnecessary for reproducing the reported experiments.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
Open Science Artifacts required for evaluation. To evaluate the contributions of this paper, reviewers need access to the artifacts listed below. • The synthetic training dataset used in our controlled experiments, together with the forward mixing functions used to generate mixed APT technique sequences. • The zero-shot evaluation inputs and metadata for the five public benchmark datasets used in this paper. • The CAPTure dataset, including the associated labeling YAML files and metadata needed to reproduce the end-toend evaluation. • The FASTopic model checkpoint and the corresponding training vocabulary required for topic inference. • The TGCM model checkpoint, inference scripts, and example inputs for reproducing the reported downstream demixing results. • Supporting documentation, including environment specifications, dependency information, and step-by-step instructions for running the provided inference pipeline. Data availability. The datasets used in this work are available through their official distribution channels or through our anonymous artifact release when required for reproducibility. Specifically, our experiments use: (i) the synthetic training dataset constructed using SAGA for this study, (ii) public evaluation datasets including ATLAS, NODLINK, ProvCon, DARPA Transparent Computing TC-E3, and DARPA Transparent Computing TC-E5, and (iii) the CAPTure dataset introduced in this work. For the public datasets used in items (i) and (ii), the official access pages are: • SAGA [33]: https://www.saga-cyber.net/dataset • ATLAS [3]: https://github.com/purseclab/ATLAS • NODLINK [44]: https://github.com/PKU-ASAL/SimulatedData • ProvCon [78]: https://github.com/NUS-Curiosity/provcon • DARPA TC-E3 [1]: https://github.com/darpa-i2o/Transpar ent-Computing/blob/master/README-E3.md • DARPA TC-E5 [36]: https://github.com/darpa-i2o/Transpar ent-Computing/blob/master/README.md For item (iii), CAPTure dataset is available at: https://anonym ous.4open.science/r/TGCM-9579/ We also provide the evaluation files through the anonymous artifact release hosted on anonymous.4open.science. The release also includes the labeling files and data organization needed to reproduce the experiments reported in the paper. Code availability. At submission time, we release an anonymous code artifact on anonymous.4open.science to preserve doubleblind review and avoid inadvertently disclosing author identities through repository metadata, commit history, or packaging details. The anonymous artifact is available at https://anonymous.4ope n.science/r/TGCM-9579/. The artifact is organized to support review-time inspection and reproduction of the released TGCM experiments. Specifically, it contains: • DARPA TC-E5 inference package for Table 5. The directory InferenceDARPAE5/ contains the released TGCM
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
inference workflow for the DARPA TC-E5 experiment, including InferenceDemo.ipynb, tgcm_train_module.py, and the API run_darpa_e5_tgcm_summary used to reproduce the reported TGCM results for the evaluated DARPA E5 settings. • DARPA TC-E5 model and feature assets. The DARPA E5 package includes pretrained TGCM checkpoints from mix2_ckp.pt to mix6_ckp.pt, FASTopic portable assets K3_CYBERT_theta_cache.pkl, K3_CYBERT_beta.npy, and K3_CYBERT_vocab.json, and the MITRE techniquedescription mapping MITRE_Description_Mapping.pkl required to construct the topic-informed TGCM inputs. • CAPTure inference package for Table 7. The directory CAPTure/ contains the standalone TGCM inference demo In ferenceDemo.py for the CAPTure Table 7 comparison. The script loads processed upstream extractor outputs, constructs TGCM inputs, loads the released checkpoint, runs inference, and prints clustering metrics together with the estimated number of campaigns 𝐾ˆ and the 𝐾–𝐾ˆ mean absolute error. • CAPTure upstream extractor outputs. The directory CA PTure/extractor_results/ contains compact processed prediction files from the three upstream extractors used in Table 7: SFM, Zoomer, and TREC. These files are organized by extractor and mixture size from mix2 to mix6, and are the direct inputs consumed by the released CAPTure inference script. • CAPTure TGCM checkpoints and auxiliary assets. The CAPTure package includes pretrained TGCM checkpoints from c a p t u r e _ k 2 _ c k p . p t to c a p t u r e _ k 6 _ c k p . p t, FASTopic portable assets, and a MITRE techniquedescription mapping. These files allow the CAPTure inference script to run without referring to any private training directory or author-specific path. • CAPTure labeling utilities. The artifact includes the rulebased Procmon labeling script CAPTure/label.py, the YAML rule library under CAPTure/label_rule/, and the notebook Mix_dataset_to_overleaf_table.ipynb for exporting CAPTure mix statistics. The raw CAPTure CSV/PML traces are not committed due to size, but download instructions and expected placement paths are documented in the released README files. • Standalone FASTopic utilities. The directory f a s t o p ic/ contains the standalone FASTopic asset preparation workflow, including fastopic_standalone.py, TopicM etrics.py, the vendored Our_fastopic/ implementation, packaged FASTopic dataset files, and command examples for copying checkpoints (fastopic check point is available at: https://anonymous.4open.science/r/TGCM-9579/) and exporting portable topic-model assets. • LLM baseline outputs for Figure 4. The directory LLMR esults/ contains the released serialized baseline outputs for the LLM comparisons, including GPT-4.1-nano, Gemini2.5-flash-lite, Grok-4-fast-non-reasoning, and Grok-4-fastreasoning.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
• Environment and hardware metadata. The directory conda/TGCM/ provides reproducibility snapshots, including the full Conda environment file, minimal environment file, explicit Conda package list, and pip freeze output. The directory hardware/ records the hardware and system configuration used for reproducibility reference. • Documentation and runnable commands. The root README and subdirectory README files describe the artifact layout, external download locations, expected folder structure, dependency setup, and example commands for running the DARPA TC-E5 and CAPTure inference workflows.
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
Generative AI Usage We used generative AI tools only for language polishing, grammar checking, and clarity improvements during manuscript preparation. All technical claims, experimental results, citations, artifact descriptions, and conclusions were written, verified, and approved by the authors. No generative AI tool was used to generate experimental data, fabricate results, create references, or perform autonomous scientific analysis.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
A
Appendix : Train / Valid Data Statistical
B
Table 8 reports statistics for 𝐾 ∈ {2, . . . , 6}. The per-source lengths remain stable (mean ≈ 10.8), indicating comparable single-campaign trace granularity, while the interleaved-mixed sequence lengths increase with 𝐾 (≈ 21.6 → 34.6) because the observation contains more sources (approximately additive in length). Note that Count in the source block aggregates total sampled sources, whereas in the mixed block it denotes the number of mixed instances (𝑁 ). Table 8: Length statistics of (i) single-APT source technique sequences before mixing and (ii) mixed technique sequences after interleaving (𝐾 ∈ {2, . . . , 6}). In the source block, Count is the total number of sampled source campaigns aggregated Í over all mixed instances, i.e., 𝑛𝑖=1 𝐾𝑖 (not necessarily 𝐾 × 𝑛 since 𝐾𝑖 may be smaller than 𝐾). In the mixed block, Count denotes the number of mixed instances (𝑛).
𝐾
Split
Count
Min
Mean±Std
Max
5.00 5.00 5.00 5.00 5.00 5.00 5.00 5.00 5.00 5.00
10.82 ± 1.42 10.84 ± 1.40 10.82 ± 1.41 10.81 ± 1.42 10.82 ± 1.41 10.82 ± 1.43 10.82 ± 1.42 10.82 ± 1.41 10.81 ± 1.42 10.82 ± 1.42
13.00 13.00 13.00 13.00 13.00 13.00 13.00 13.00 13.00 13.00
11.00 12.00 12.00 11.00 11.00 12.00 10.00 10.00 11.00 11.00
21.64 ± 2.00 21.68 ± 1.98 24.37 ± 5.14 24.33 ± 5.14 27.68 ± 7.76 27.63 ± 7.74 31.05 ± 10.31 31.12 ± 10.33 34.53 ± 12.86 34.61 ± 12.89
26.00 26.00 39.00 39.00 52.00 52.00 64.00 64.00 75.00 76.00
Source single-APT length 2 3 4 5 6
Train Valid Train Valid Train Valid Train Valid Train Valid
204,800 204,800 230,551 230,450 261,898 261,622 293,847 294,387 326,992 327,597
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Appendix : Notation Table Table 9: Summary of Notation
Symbol
Description
𝑥 obs V 𝑤𝑖 𝑛 𝑥0
Observed mixed technique sequence at deployment. ATT&CK technique vocabulary; 𝑥 ∈ V 𝑛 . The 𝑖 -th technique. Sequence length. Canonical clean sequence formed by concatenating 𝐾 campaign sequences. Restored clean sequence predicted by TGCM. Mixed state at timestep 𝑡 , where 𝑡 ∈ {0, . . . ,𝑇 } . Total number of forward mixing steps. Ground-truth technique-level campaign labels. Predicted technique-level campaign labels. True and estimated numbers of latent campaigns. Maximum campaign budget used in unknown-𝐾 inference. Batch index and campaign/APT index.
𝑥ˆ0 𝑥𝑡 𝑇 𝑦 𝑦ˆ 𝐾, 𝐾ˆ 𝐾max 𝑏, 𝑘 𝑞 (𝑥𝑡 | 𝑥𝑡 −1 ) 𝑞 0→𝑡 (𝑥𝑡 | 𝑥 0 ) 𝑡1 , 𝑡2 𝛼 (𝑡 ) 𝑁 pairs (𝑡 ) 𝑆 (𝑡 ) 𝐿 (𝑡 ) K𝑡 𝑃𝑡 Seg(·) Interleave(·, ·) ∥
Forward Markov kernel.
𝑡 -step transition from 𝑥 0 to 𝑥𝑡 . Two timesteps from the same forward trajectory. Mixing intensity schedule. Number of activated interacting campaign pairs. Number of blocks per activated pair. Expected block length. Set of active campaigns at timestep 𝑡 . Set of interacting campaign pairs. Segmentation operator. Blockwise interleaving operator. Concatenation operator.
𝐾topic 𝐸 topic 𝛽 𝜃 (𝑠 ) 𝑀 TE 𝑝 TM ℓrec , ℓfused 𝜆 𝑐 topic
Number of latent topics. Text encoder used by FASTopic. Topic–word matrix. Soft topic allocation for sequence 𝑠 . Mapping matrix to the technique vocabulary. Topic-induced technique prior. Reconstructed and topic-fused logits. Topic-prior fusion weight. Topic-conditioning signal.
𝑓𝜃 𝑑 𝑊in 𝐸𝑡 ℎ LN(·) 𝛾, 𝛽 𝑟ˆ𝜃 𝑎 (𝑡 ) 𝐸ˆ0 𝑊out
Consistency model parameterized by 𝜃 . Embedding dimension. Input technique embedding table. Technique embeddings of 𝑥𝑡 , i.e., 𝐸𝑡 = Embed(𝑥𝑡 ;𝑊in ) . Intermediate Transformer hidden state. Layer Normalization. AdaNorm scale and shift projections. Predicted embedding-space residual. Time-dependent residual gate. Estimated clean embedding sequence. Output vocabulary projection matrix.
Lconsist LCE Laptid Ltopic L 𝑤𝑖
Consistency loss. Technique reconstruction loss. Campaign-label attribution loss. Topic-alignment loss. Overall training objective. Weight of the 𝑖 -th loss term.
A Acceval FMI, NMI 𝑃, 𝑅, 𝐹 1
Set of non-residual campaign IDs for evaluation. Macro-averaged APT-wise technique accuracy. Partition-quality metrics. Macro-averaged precision, recall, and F1-score.
Mixed APT length 2 3 4 5 6
Train Valid Train Valid Train Valid Train Valid Train Valid
102,400 102,400 102,400 102,400 102,400 102,400 102,400 102,400 102,400 102,400
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
C
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Appendix : Zero-shot across five benchmark datasets Table 10: Mapping of techniques to kill-chain phases across zero-shot evaluation datasets.
- Dataset
Init. Acc.
Execution
Persist.
Def. Eva.
Cred. Acc.
Discovery
Collect.
C2
Exfil.
ATLAS
–
T1204.002 T1059.003 T1059.001
T1053.005
T1497.001 T1055.001 T1562.001
–
T1016
–
T1071.001 T1090.001
–
NODLINK
–
T1047
–
–
–
T1482 T1083 T1057 T1018 T1082 T1124 T1033 T1016 T1049
T1119
T1105
–
ProvCon
T1566.001
–
T1574.001
–
T1003
T1087.001
–
T1105
–
DARPA_E3
T1566.001 T1566.002
T1059.004 T1204.002 T1059.001 T1059.003 T1047 T1203
T1543.003 T1053.005 T1176
T1089
T1003.008 T1555.003
T1057 T1082 T1016 T1033 T1049 T1007 T1135 T1018 T1046
T1005
T1105 T1071 T1071.001
T1041
DARPA_E5
T1189
T1204.001 T1047 T1059 T1059.003
T1197
T1055.001 T1070.004 T1055
T1003.001 T1003.008
T1083 T1033 T1057 T1082 T1049 T1046 T1016 T1007 T1087
T1074 T1005
T1071.001 T1071 T1071.004 T1105
T1048 T1041
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
D
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Appendix : Zero-shot Evaluation across five benchmark datasets Number of Campaigns (𝐾 )
Dataset
Metric
Model 2
3
4
5
6
ATLAS
Acc ↑ FMI ↑ NMI ↑ P↑ R↑ F1 ↑ Time ↓
TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet
0.4230.034 / 0.4090.017 0.5260.005 / 0.3900.008 0.0190.010 / 0.0380.004 0.5800.022 / 0.4080.014 0.5760.022 / 0.3200.021 0.5700.023 / 0.3380.018 0.0080.000 / 0.8030.056
0.4010.031 / 0.2880.010 0.4550.005 / 0.3210.010 0.0450.013 / 0.0740.007 0.2680.010 / 0.2340.007 0.4080.015 / 0.2530.014 0.3150.014 / 0.2250.009 0.0080.000 / 0.8230.016
0.3430.029 / 0.2830.004 0.3730.006 / 0.3370.002 0.0590.020 / 0.0370.003 0.1820.012 / 0.1470.002 0.2940.008 / 0.2840.004 0.2110.008 / 0.1900.003 0.0090.000 / 0.8390.020
– – – – – – –
– – – – – – –
NODLINK
Acc ↑ FMI ↑ NMI ↑ P↑ R↑ F1 ↑ Time ↓
TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet
0.3320.035 / 0.4780.010 0.5080.005 / 0.5310.005 0.0110.008 / 0.0650.010 0.5570.023 / 0.4480.013 0.5560.023 / 0.4410.012 0.5560.023 / 0.3950.012 0.0080.000 / 0.8190.128
0.4240.040 / 0.3390.007 0.4770.014 / 0.4650.003 0.0700.024 / 0.0350.004 0.2190.012 / 0.2400.003 0.3570.011 / 0.3350.002 0.2630.013 / 0.2390.004 0.0090.001 / 0.8350.087
– – – – – – –
– – – – – – –
– – – – – – –
ProvCon
Acc ↑ FMI ↑ NMI ↑ P↑ R↑ F1 ↑ Time ↓
TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet
0.7220.021 / 0.3420.030 0.5450.017 / 0.4420.037 0.0190.015 / 0.4900.038 0.5790.035 / 0.2750.028 0.5660.027 / 0.2920.027 0.5490.026 / 0.2790.028 0.0080.000 / 0.2400.017
0.7060.013 / 0.2740.014 0.4150.006 / 0.3310.020 0.0100.005 / 0.3260.027 0.2970.048 / 0.1920.011 0.2940.012 / 0.2640.016 0.2380.008 / 0.2100.013 0.0080.000 / 0.4700.023
0.7020.023 / 0.2340.014 0.4750.004 / 0.2600.013 0.0410.007 / 0.2920.016 0.0760.004 / 0.1360.009 0.2520.001 / 0.2320.016 0.1080.004 / 0.1610.010 0.0090.000 / 0.6900.021
0.6780.019 / 0.1880.012 0.3680.004 / 0.2630.010 0.0430.008 / 0.2530.013 0.2870.008 / 0.0900.004 0.1870.010 / 0.1930.010 0.1110.009 / 0.1140.005 0.0090.000 / 0.7620.013
0.7320.014 / 0.1510.005 0.3460.009 / 0.2540.007 0.0890.015 / 0.2320.007 0.0600.004 / 0.0620.003 0.1690.006 / 0.1500.008 0.0880.004 / 0.0810.003 0.0100.000 / 0.7490.006
DARPA TC-E3
Acc ↑ FMI ↑ NMI ↑ P↑ R↑ F1 ↑ Time ↓
TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet
0.4600.038 / 0.4610.026 0.5870.008 / 0.4270.015 0.0250.016 / 0.1630.030 0.6000.035 / 0.4230.025 0.5670.025 / 0.4320.028 0.5280.035 / 0.4010.025 0.0310.011 / 1.1700.256
0.3920.039 / 0.3370.022 0.4240.004 / 0.4240.027 0.0080.003 / 0.2180.021 0.5070.145 / 0.2450.014 0.3520.019 / 0.3080.016 0.2840.016 / 0.2530.014 0.0410.012 / 1.6830.303
0.4380.035 / 0.2640.023 0.3580.002 / 0.4600.025 0.0040.002 / 0.2200.017 0.1400.008 / 0.1600.013 0.2750.004 / 0.2540.015 0.1850.008 / 0.1770.013 0.0390.012 / 2.0430.417
0.4120.048 / 0.1950.017 0.3190.002 / 0.4810.018 0.0090.004 / 0.2500.010 0.0840.008 / 0.0990.007 0.2130.008 / 0.2020.007 0.1200.009 / 0.1200.007 0.0480.016 / 1.8390.246
0.4130.026 / 0.1570.013 0.2910.001 / 0.4870.022 0.0130.006 / 0.2870.014 0.0560.006 / 0.0700.007 0.1660.008 / 0.1590.008 0.0830.007 / 0.0850.005 0.0560.017 / 1.8730.349
DARPA TC-E5
Acc ↑ FMI ↑ NMI ↑ P↑ R↑ F1 ↑ Time ↓
TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet TGCM / DANet
0.8660.027 / 0.5660.159 0.5550.009 / 0.6600.000 0.1310.023 / 0.3240.001 0.6270.023 / 0.5540.141 0.6320.022 / 0.5690.175 0.5530.020 / 0.5350.156 0.0250.007 / 0.0120.004
– – – – – – –
0.6990.057 / 0.4500.079 0.5560.018 / 0.5530.008 0.1130.042 / 0.2430.018 0.5340.043 / 0.4190.076 0.5090.039 / 0.3950.079 0.4520.045 / 0.3790.070 0.0280.005 / 0.0320.017
– – – – – – –
– – – – – – –
↑ indicates that a higher value is better, and ↓ indicates that a lower value is better.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
E
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Appendix : Structure-Aware Forward Mixing: Full Definitions
This appendix provides the exact schedules and operator definitions for the structure-aware forward mixing kernel 𝑞(𝑥𝑡 | 𝑥𝑡 −1 ) used in Section 5.1. Let 𝑡 ∈ {0, . . . ,𝑇 } be the discrete timestep, 𝑡 0 the mixing onset, and 𝑡 ★ the saturation point.
E.1
Interaction Schedule
We define a normalized progress variable 𝑢 (𝑡) ∈ [0, 1] and a cosine-ramp mixing intensity 𝛼 (𝑡) ∈ [0, 1]: 𝑢 (𝑡) = min 1, max 0, 𝑡𝑡★−𝑡−𝑡00 , 𝛼 (𝑡) = 21 1 − cos(𝜋𝑢 (𝑡)) .
(20) (21)
The mixing intensity controls: the number of activated disjoint pairs 𝑁 pairs (𝑡), the number of blocks per pair 𝑆 (𝑡), and the expected block length 𝐿(𝑡): 𝑁 pairs (𝑡) = round 𝑁 min + 𝛼 (𝑡)(𝑁 max − 𝑁 min ) , (22) 𝑆 (𝑡) = round 𝑆 min + 𝛼 (𝑡)(𝑆 max − 𝑆 min ) , (23) 𝐿(𝑡) = 𝐿0 + 𝛼 (𝑡)(𝐿1 − 𝐿0 ).
(24)
Here 𝑁 pairs (𝑡) ∈ [𝑁 min, 𝑁 max ] is the number of activated interacting pairs at step 𝑡, 𝑆 (𝑡) ∈ [𝑆 min, 𝑆 max ] is the number of blocks per activated pair, and 𝐿(𝑡) is the expected block length interpolated from 𝐿0 to 𝐿1 (larger 𝑡 yields shorter blocks when 𝐿1 < 𝐿0 ).
E.2
Granularity Schedule (Segmentation Operator)
For any sequence 𝐴, the segmentation operator (𝐴1, . . . , 𝐴𝑆 (𝑡 ) ) = Seg 𝐴; 𝑆 (𝑡), 𝐿(𝑡)
(25)
partitions 𝐴 into 𝑆 (𝑡) consecutive blocks that preserve order: 𝐴 = 𝐴1 ∥𝐴2 ∥ · · · ∥𝐴𝑆 (𝑡 ) .
(26)
We require Seg(·) to satisfy: (i) blocks are contiguous and order-preserving, (ii) the concatenation recovers the original sequence, and (iii) the expected block length is controlled by 𝐿(𝑡) (i.e., E[|𝐴𝑖 |] ≈ 𝐿(𝑡)), so increasing 𝑡 induces finer segmentation (shorter blocks). The same segmentation is applied to the paired sequence 𝐵: (𝐵 1, . . . , 𝐵𝑆 (𝑡 ) ) = Seg 𝐵; 𝑆 (𝑡), 𝐿(𝑡) . (27)
E.3
Mixed Operator (Pair Sampling and Interleaving)
Let K be the set of active campaigns at step 𝑡. We sample a set of disjoint interacting pairs P𝑡 ⊆ K × K,
|P𝑡 | = 𝑁 pairs (𝑡),
(28)
where disjoint means each campaign participates in at most one pair in P𝑡 at a given 𝑡. Given segmented blocks of a selected pair (𝐴, 𝐵) ∈ P𝑡 , we define the interleaving operator: Interleave(𝐴, 𝐵) = 𝐴1 ∥𝐵 1 ∥ · · · ∥𝐴𝑆 (𝑡 ) ∥𝐵𝑆 (𝑡 ) .
(29)
This operator preserves within-block order while altering the global temporal arrangement across campaigns. At step 𝑡, we apply Seg and Interleave to every (𝐴, 𝐵) ∈ P𝑡 to produce updated sequences, while campaigns not in P𝑡 remain unchanged. The resulting global sequence after processing all pairs defines 𝑥𝑡 and thus the Markov kernel 𝑞(𝑥𝑡 | 𝑥𝑡 −1 ).
E.4
Label Propagation (Technique-to-Campaign)
Recall the technique-level campaign labels 𝑦 ∈ {0, . . . , 𝐾 }𝑛 defined on the clean concatenation 𝑥 0 . Since the forward operator reorders techniques via block interleaving, we propagate labels by applying the same block-level permutation to 𝑦 as is applied to 𝑥 at each step: if 𝑥𝑡 is obtained from 𝑥𝑡 −1 by concatenating a sequence of blocks in some order, then 𝑦𝑡 is obtained by concatenating the corresponding label blocks in the identical order. This ensures each technique in 𝑥𝑡 retains its originating campaign ID, including the explicit handling of technique reuse by allowing identical techniques to carry different IDs under different contexts.
E.5
Trajectory Sampling for Training
We compose the one-step kernel to obtain 𝑞 0→𝑡 (𝑥𝑡 | 𝑥 0 ) and sample training pairs along the same trajectory: (𝑥𝑡1 , 𝑥𝑡2 , 𝑦, 𝐾, 𝑡 1, 𝑡 2 ),
𝑥𝑡 ∼ 𝑞 0→𝑡 (𝑥𝑡 | 𝑥 0 ).
(30)
In practice, one may equivalently carry a single label sequence aligned to each sampled 𝑥𝑡 (i.e., 𝑦𝑡 ), since the forward process deterministically induces the same reindexing on technique and labels given the sampled schedules and pairings.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
F
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Appendix : Information-Theoretic Interpretation
We provide an information-theoretic interpretation of our objective by viewing mixed-APT decomposition as maximizing the mutual information 𝐼 (𝑥 obs ; 𝑥 0, 𝑦) between the observation and the ground truth. Using the chain rule: 𝐼 (𝑥 obs ; 𝑥 0, 𝑦) = 𝐼 (𝑥 obs ; 𝑦) + 𝐼 (𝑥 obs ; 𝑥 0 | 𝑦) Our loss functions map directly to these components: (1) Campaign Identification (𝐼 (𝑥 obs ; 𝑦)): Laptid optimizes source attribution. (2) Sequence Reconstruction (𝐼 (𝑥 obs ; 𝑥 0 | 𝑦)): LCE , Ltopic maximize the likelihood of true techniques under semantic constraints. (3) Timestep Invariance: Lconsist enforces 𝐼 (𝑥ˆ0(𝑡1 ) ; 𝑥 0, 𝑦) ≈ 𝐼 (𝑥ˆ0(𝑡2 ) ; 𝑥 0, 𝑦), preserving information along the diffusion trajectory.
(31)
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
G
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Appendix: CAPTure: CALDERA-Procmon APT Trace Dataset
We construct CAPTure, a host-level audit dataset for studying interleaved multi-APT behaviors under realistic execution noise. The dataset is built with MITRE CALDERA v5.3.0 [52] for attack orchestration and Process Monitor (Procmon) [49] for host-side event collection. Each run corresponds to one mixed-APT instance executed on a single Windows 11 Home virtual machine in VMware [72], with one Sandcat agent deployed on that host. Our attack pool is curated from locally available CALDERA adversaries and abilities, using MITRE ATT&CK group pages as the primary reference and retaining only techniques that can be executed by the available CALDERA abilities. The resulting pool contains 19 APT groups. Table 12 summarizes the executable APT-to-tactic mapping, showing that different groups contribute distinct technique subsets across tactic categories and thus provide the behavioral diversity needed to construct interleaved mixed-APT traces. To generate mixed traces, multiple CALDERA operations are allowed to run concurrently on the same agent, so techniques from different APTs may overlap within a single execution window. Procmon is started before attack execution and stopped after all abilities have completed, producing one complete host trace per run. Each trace is then exported to CSV, copied out of the virtual machine, and preserved before restoring the snapshot for the next run. We organize the collected data by mixing level, with separate per-run statistics reported for Mix-2 through Mix-6 subsets. These tables summarize the constituent APT combinations, total event volume, trace size, benign and malicious event counts, and malicious ratios. Together, they quantify the scale and sparsity of the collected traces and provide empirical context for the labeling procedure described next.
G.1
Technique-Level Event Labeling
To convert raw Procmon traces into auditable technique-level evidence, we align two sources for each run: CALDERA execution metadata and exported Procmon CSV events. CALDERA records the execution context of each ability instance, including the attributed APT, ability identifier, mapped ATT&CK technique, process context, and execution time window. Procmon records the corresponding host-side event stream, including timestamps, process names, operations, accessed paths, and event details. Event labeling is therefore performed by matching Procmon events to plausible CALDERA executions under a shared execution context, rather than by relying on isolated keywords alone. The matching logic is implemented as a human-curated YAML rule base (e.g. Figure 5). In its current version, the rule base contains 179 rule files, covering 82 unique ATT&CK techniques and 179 unique CALDERA abilities, with all rule files successfully parsed without errors, as summarized in Table 11. Coverage is intentionally uneven across techniques, reflecting the fact that some techniques are represented by only a few executable CALDERA abilities, whereas others recur across multiple abilities in our attack pool. At the technique level, the median coverage is 2 abilities per technique: 40 techniques are supported by a single ability, 20 by two abilities, 16 by three to four abilities, and 6 by at least five abilities. Representative high-coverage techniques include T1057 (9 abilities), T1016/T1018/T1059.001 (8 each), T1005 (7), and T1548.002 (5). When both ability-specific and technique-level rules are available, we prefer the former because they better capture the concrete execution semantics of a particular CALDERA ability. Operationally, labeling proceeds in three stages. First, for each CALDERA execution instance, we generate candidate Procmon events that fall within the relevant execution context, primarily using PID consistency when available; for techniques that naturally induce cross-process effects, we allow broader process-chain conditions. Second, we apply rule-based filtering to retain only events whose operations, process names, accessed artifacts, or textual details are consistent with the expected behavior of the candidate technique, while also enforcing exclusion conditions for common non-target patterns. Third, we resolve labels at the event level: if no valid execution candidate remains, the event is marked as benign; if exactly one candidate is well supported, the event is assigned to that technique; and if multiple candidates remain indistinguishable, the event is preserved as ambiguous rather than being forced into a single class. For each labeled event, we retain traceable evidence including the attributed APT, ability, technique, and rule-matching rationale, so that annotations remain auditable after labeling. Importantly, these event-level labels are not used as direct inputs to TGCM. Instead, they provide an intermediate supervision layer for constructing and evaluating upstream technique-recognition models, whose predicted technique sequences are then passed to TGCM. This design is consistent with the scope of our framework: TGCM operates after the abstraction/extraction stage, rather than directly on raw host telemetry.
Table 11: Summary statistics of the Procmon rule base used for technique-level event labeling. Metric
Count
YAML rule files Unique ATT&CK techniques Unique CALDERA abilities Median abilities per technique Parsing errors
179 82 179 2 0
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Figure 5: Example of a manually crafted labeling rule used in CAPTure. We write such rules for CALDERA abilities to detect their execution traces in raw audit logs and assign the corresponding ATT&CK technique labels. Each rule specifies required conditions, event-operation types, process constraints, regex-based matching fields, keywords, and exclusions to support ability-level dataset annotation.
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
G.2
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Handling High-Frequency Normal-Looking Behaviors
A practical challenge in host-level tracing is that some ATT&CK techniques naturally resemble routine system activity. Discovery-related behaviors, for example, may generate large numbers of file, directory, registry, or process-access events that are also common in benign workloads. Labeling such events solely by operation type would therefore introduce substantial false positives. We address this issue with a conservative, context-aware policy. Common operations are accepted only when they are tied to campaignlinked execution context, such as a matched process context together with supporting artifact or command clues. High-frequency techniques are required to satisfy stronger contextual evidence than rare or highly distinctive behaviors. When the available evidence is insufficient to separate competing candidates, the event is explicitly retained as ambiguous rather than being forced into a single technique class. This conservative design improves annotation reliability in realistic mixed traces, particularly for common system activities that may appear malicious when viewed in isolation.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Table 12: APT-to-tactic mapping in CAPTure. Rows denote the APT groups included in our CALDERA-based attack pool, and columns correspond to the ATT&CK tactic categories used in this study. Each cell lists the executable ATT&CK technique IDs associated with the corresponding group under that tactic. Empty cells indicate that no supported technique from that group is included in the given tactic category. Group
Init. Acc.
Execution
Persist.
Def. Eva.
Cred. Acc.
Discovery
Collect.
C2
Exfil.
admin338
T1566.001
T1204.002
–
–
–
T1087.001 T1083 T1069.001 T1016 T1049 T1007
–
–
–
CobaltGroup
T1566.001
T1204.002
–
–
–
T1046
–
T1219
–
FIN7
T1566.001
T1204.002
T1547.001 T1053.005
–
–
–
–
T1105
–
Gamaredon
T1566.001
T1204.002 T1047
T1547.001 T1053.005
T1112
–
T1082
–
T1071.001
–
GorgonGroup
T1566.001
T1204.002 T1059.001
T1547.001 T1547.009
T1055.002 T1562.001 T1564.003
–
–
–
–
–
Higaisa
T1566.001
T1204.002
T1547.001 T1053.005
T1036.004
–
T1082 T1016
–
–
–
Patchwork
T1566.001
T1204.002 T1059.001
T1547.001
T1548.002
–
T1033 T1518.001
T1005
–
–
APT1
–
T1059.003
–
–
–
T1087.001
T1560.001 T1119 T1005
–
–
APT3
–
T1059.001
T1547.001
–
–
T1087.001
T1560.001
–
–
APT5
–
T1059.001 T1059.003
–
–
–
T1083
T1560.001 T1074.001
–
–
APT18
–
T1059.003
T1547.001
–
–
T1083 T1082
–
T1071.001 T1105
–
APT28
T1566.001
T1204.002
–
–
–
T1082
T1005
T1071.001
T1567
APT29
–
T1059.001
T1547.001
T1548.002
–
–
T1560.001
T1071.001
–
APT32
–
–
T1053.005
–
–
T1087.001 T1082 T1016 T1049 T1033
–
T1071.001
–
APT33
–
T1059.001
T1547.001
–
–
–
T1560.001
T1071.001
–
APT37
–
–
T1547.001
T1548.002
–
–
T1123
T1071.001
–
APT39
–
–
T1547.001 T1547.009
–
–
–
T1560.001 T1115
T1071.001
–
APT41
–
T1059.003
–
–
–
T1087.001
T1560.001
T1071.001
–
APT42
–
T1059.001
T1547
–
–
T1087.001
–
T1071.001
–
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Table 13: Per-run statistics of the CAPTure Mix-2 subset. APT Mix admin338 + apt37 apt1 + apt39 apt1 + higaisa apt28 + apt41 apt28 + gorgongroup apt29 + apt39 apt29 + apt3 apt32 + higaisa apt33 + admin338 apt33 + cobaltgroup apt37 + apt33 apt39 + gorgongroup apt3 + apt5 apt3 + patchwork cobaltgroup + apt37 cobaltgroup + apt41 fin7 + apt37 gamaredon + apt33 gorgongroup + higaisa patchwork + higaisa
#APTs
Total Events
Size (GB)
Benign Events
Malicious Events
Malicious Ratio (%)
2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2
2306354 1355367 3227772 2162205 3379498 2331258 2404039 2272401 3196201 3716427 2043992 3260124 3932072 3309466 2655100 2654367 2960863 3187196 3474731 2558055
0.807 0.518 1.125 0.789 1.220 0.840 0.859 0.806 1.121 1.341 0.734 1.178 1.382 1.178 0.980 0.989 1.015 1.118 1.237 0.919
2305420 1324476 3199425 2133500 3347877 2327550 2402799 2271772 3194739 3714823 2043154 3253812 3930327 3280959 2654013 2652741 2960388 3186134 3470728 2529778
934 30891 28347 28705 31621 3708 1240 629 1462 1604 838 6312 1745 28507 1087 1626 475 1062 4003 28277
0.04 2.28 0.88 1.33 0.94 0.16 0.05 0.03 0.05 0.04 0.04 0.19 0.04 0.86 0.04 0.06 0.02 0.03 0.12 1.11
Table 14: Per-run statistics of the CAPTure Mix-3 subset. APT Mix admin338 + apt33 + apt39 admin338 + fin7 + apt1 admin338 + fin7 + apt41 admin338 + gamaredon + apt37 apt1 + cobaltgroup + apt29 apt29 + apt41 + apt37 apt29 + gamaredon + apt5 apt32 + apt33 + apt39 apt33 + patchwork + apt5 apt37 + apt5 + higaisa apt3 + apt41 + gamaredon apt42 + gorgongroup + admin338 apt5 + apt39 + apt33 cobaltgroup + fin7 + apt28 fin7 + apt28 + apt18 gamaredon + apt29 + cobaltgroup gorgongroup + apt42 + admin338 gorgongroup + apt5 + cobaltgroup higaisa + fin7 + patchwork patchwork + apt37 + apt42
#APTs
Total Events
Size (GB)
Benign Events
Malicious Events
Malicious Ratio (%)
3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3
3303061 2678556 2653823 2657632 3787442 2229016 5323224 2426438 5458338 4231794 4066861 4526849 4262577 2945836 2563269 4039742 4493568 5780041 3195873 3508912
1.172 0.959 0.935 0.923 1.390 0.796 1.846 0.870 1.912 1.474 1.395 1.585 1.502 1.106 0.919 1.449 1.578 2.081 1.130 1.233
3299034 2648268 2651996 2656262 3757448 2227998 5320946 2421859 5428503 4230177 4065218 4522518 4257628 2916651 2534012 4037781 4488835 5774164 3167320 3480586
4027 30288 1827 1370 29994 1018 2278 4579 29835 1617 1643 4331 4949 29185 29257 1961 4733 5877 28553 28326
0.12 1.13 0.07 0.05 0.79 0.05 0.04 0.19 0.55 0.04 0.04 0.10 0.12 0.99 1.14 0.05 0.11 0.10 0.89 0.81
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Table 15: Per-run statistics of the CAPTure Mix-4 subset. APT Mix admin338 + apt41 + gorgongroup + apt28 admin338 + higaisa + apt1 + apt37 apt18 + apt3 + patchwork + admin338 apt18 + apt42 + patchwork + apt33 apt1 + apt32 + apt39 + fin7 apt1 + gorgongroup + admin338 + apt3 apt29 + gamaredon + apt33 + patchwork apt37 + apt18 + apt1 + apt28 apt37 + apt33 + cobaltgroup + apt1 apt37 + apt3 + fin7 + apt28 apt37 + fin7 + apt18 + apt1 apt3 + apt42 + fin7 + apt28 apt42 + apt32 + apt39 + higaisa apt42 + apt32 + higaisa + patchwork apt42 + apt39 + admin338 + gamaredon apt42 + gamaredon + apt33 + apt3 apt5 + fin7 + apt42 + apt1 apt5 + patchwork + cobaltgroup + apt37 gorgongroup + higaisa + apt32 + apt42 patchwork + apt37 + apt32 + apt42
#APTs
Total Events
Size (GB)
Benign Events
Malicious Events
Malicious Ratio (%)
4
4816815
1.742
4784258
32557
0.68
4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
3012450 4752760 6076437 3039155 4522085 6094284 2805418 3818831 3673256 2942046 3324085 4609563 5173324 4446380 4694657 5574927 5631959 5688324 8595232
1.054 1.706 2.146 1.082 1.611 2.152 0.998 1.402 1.298 1.034 1.194 1.650 1.837 1.521 1.613 1.944 2.075 2.035 3.267
2982743 4722495 6046676 3007791 4489101 6064704 2748387 3788454 3643701 2912264 3295044 4605741 5144703 4441969 4693360 5544953 5601024 5683941 8567072
29707 30265 29761 31364 32984 29580 57031 30377 29555 29782 29041 3822 28621 4411 1297 29974 30935 4383 28160
0.99 0.64 0.49 1.03 0.73 0.49 2.03 0.80 0.80 1.01 0.87 0.08 0.55 0.10 0.03 0.54 0.55 0.08 0.33
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Table 16: Per-run statistics of the CAPTure Mix-5 subset. APT Mix apt18 + apt29 + gamaredon + apt3 + apt39 apt18 + apt33 + apt42 + apt5 + apt39 apt1 + apt18 + higaisa + apt32 + apt41 apt1 + higaisa + apt18 + admin338 + apt28 apt28 + apt41 + apt18 + apt1 + apt5 apt28 + apt42 + fin7 + apt29 + gamaredon apt29 + admin338 + apt28 + apt1 + fin7 apt32 + apt33 + apt41 + apt5 + apt29 apt32 + fin7 + gamaredon + admin338 + apt18 apt33 + apt1 + apt29 + admin338 + fin7 apt37 + apt28 + apt33 + apt3 + apt1 apt39 + apt5 + fin7 + patchwork + apt33 apt3 + gorgongroup + apt33 + apt1 + apt37 apt41 + apt33 + apt18 + apt28 + fin7 apt42 + apt39 + cobaltgroup + apt3 + apt1 cobaltgroup + admin338 + patchwork + apt29 + apt37 cobaltgroup + apt1 + higaisa + apt5 + apt28 cobaltgroup + apt39 + apt18 + patchwork + gamaredon fin7 + patchwork + apt33 + higaisa + apt37 gorgongroup + higaisa + apt3 + fin7 + apt32
#APTs
Total Events
Size (GB)
Benign Events
Malicious Events
Malicious Ratio (%)
5
6804103
2.377
6797930
6173
0.09
5 5 5
4768345 3060962 4312318
1.663 1.077 1.538
4762296 3029335 4254571
6049 31627 57747
0.13 1.03 1.34
5 5
4352374 7502961
1.562 2.559
4293700 7473562
58674 29399
1.35 0.39
5 5 5
4135016 5330546 6073935
1.467 1.952 2.113
4077416 5325991 6070565
57600 4555 3370
1.39 0.09 0.06
5 5 5 5
6052455 5335117 5958465 7361896
2.149 1.872 2.098 2.581
6022109 5278782 5925430 7327982
30346 56335 33035 33914
0.50 1.06 0.55 0.46
5 5
3856212 4754049
1.359 1.729
3825675 4721951
30537 32098
0.79 0.68
5
5464044
1.928
5433659
30385
0.56
5
5444703
1.962
5386462
58241
1.07
5
6998637
2.440
6964466
34171
0.49
5
5836774
1.997
5807347
29427
0.50
5
5097225
1.783
5092432
4793
0.09
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Table 17: Per-run statistics of the CAPTure Mix-6 subset. APT Mix apt29 + higaisa + patchwork + apt42 + apt33 + gorgongroup apt32 + apt5 + apt1 + apt3 + apt18 + fin7 apt33 + apt5 + gorgongroup + apt42 + apt37 + apt32 apt33 + gorgongroup + apt5 + apt18 + apt29 + apt32 apt37 + apt41 + apt39 + gamaredon + cobaltgroup + apt32 apt3 + apt29 + higaisa + gorgongroup + apt18 + apt41 apt42 + apt32 + apt37 + apt3 + admin338 + higaisa apt42 + apt5 + fin7 + cobaltgroup + admin338 + apt1 apt5 + apt3 + fin7 + apt1 + apt42 + apt29 apt5 + fin7 + apt41 + gorgongroup + patchwork + apt28 cobaltgroup + higaisa + apt41 + apt42 + apt1 + apt29 fin7 + apt32 + apt33 + apt18 + apt1 + higaisa gamaredon + apt3 + patchwork + apt41 + apt1 + apt32 gamaredon + fin7 + apt1 + cobaltgroup + apt41 + gorgongroup gorgongroup + apt33 + cobaltgroup + apt28 + higaisa + apt37 gorgongroup + apt37 + apt42 + apt18 + apt41 + apt28 higaisa + cobaltgroup + gamaredon + apt37 + apt5 + patchwork patchwork + apt1 + apt32 + apt37 + fin7 + apt33 patchwork + apt33 + higaisa + apt29 + fin7 + gamaredon patchwork + apt41 + cobaltgroup + apt32 + apt5 + apt37
#APTs
Total Events
Size (GB)
Benign Events
Malicious Events
Malicious Ratio (%)
6
8598606
3.032
8562726
35880
0.42
6 6
6274837 7704325
2.213 2.728
6243805 7698034
31032 6291
0.49 0.08
6
8591321
3.019
8584343
6978
0.08
6
8233608
2.888
8228117
5491
0.07
6
8510696
2.988
8503506
7190
0.08
6
6665756
2.356
6663304
2452
0.04
6
7066807
2.546
7034826
31981
0.45
6 6
5349124 8591580
1.971 2.997
5317930 8530344
31194 61236
0.58 0.71
6
6583359
2.364
6552632
30727
0.47
6
4433411
1.628
4403251
30160
0.68
6
5794465
2.068
5706769
87696
1.51
6
5864818
2.151
5831047
33771
0.58
6
6440205
2.357
6405911
34294
0.53
6
5899232
2.133
5865609
33623
0.57
6
8599101
2.970
8568407
30694
0.36
6
7120848
2.579
7063744
57104
0.80
6
8597963
2.955
8567378
30585
0.36
6
6220925
2.250
6189859
31066
0.50
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Table 18: Detailed end-to-end results on CAPTure under unknown mixture cardinality 𝐾. For each upstream system, we report clustering quality, attribution quality, and inference time across mixture sizes 𝐾 = 2 to 𝐾 = 6. Each cell is reported as meanstd , where the subscript denotes the standard deviation over 10 repeated runs.
Upstream
Model
TGCM (K=6) SFM DANet (K=6)
TGCM (K=6) ZOOMER DANet (K=6)
TGCM (K=6) TREC DANet (K=6)
K
Acc ↑
FMI ↑
NMI ↑
P↑
R↑
F1 ↑
Time ↓
2 3 4 5 6 2 3 4 5 6
0.8070.023 0.6690.035 0.5690.049 0.4410.085 0.4350.100 0.3900.027 0.2840.013 0.2720.013 0.2190.011 0.1690.019
0.6080.015 0.4800.016 0.3970.008 0.3340.008 0.2980.009 0.4650.001 0.3810.005 0.3830.001 0.3360.004 0.3080.002
0.0580.018 0.0840.015 0.1320.012 0.1500.016 0.1880.018 0.1180.001 0.1250.003 0.1960.006 0.1700.005 0.1790.002
0.3760.021 0.2310.020 0.2000.011 0.1430.014 0.1420.016 0.3740.020 0.2210.014 0.1990.014 0.1450.012 0.0990.022
0.4600.021 0.3250.015 0.2730.010 0.1950.004 0.2010.016 0.3110.018 0.2470.009 0.2350.017 0.1990.012 0.1730.016
0.3740.021 0.2370.017 0.2050.008 0.1410.010 0.1380.014 0.3120.019 0.2070.010 0.1910.012 0.1450.008 0.1110.015
0.0080.000 0.0080.000 0.0090.000 0.0090.000 0.0100.000 0.0240.005 0.0230.001 0.0230.000 0.0240.000 0.0260.002
2 3 4 5 6 2 3 4 5 6
0.6230.025 0.4800.073 0.3750.135 0.4500.052 0.4320.088 0.4620.024 0.2780.014 0.2280.014 0.1890.012 0.1650.007
0.5190.013 0.4170.013 0.3290.013 0.3130.009 0.2370.010 0.4830.005 0.3990.004 0.3550.001 0.2570.003 0.2400.004
0.0550.009 0.0540.011 0.0950.007 0.0970.007 0.1510.006 0.0670.001 0.1120.002 0.0890.002 0.1180.003 0.1200.005
0.4670.020 0.2670.012 0.2190.009 0.1740.019 0.1320.007 0.4420.037 0.2340.016 0.1590.013 0.1410.016 0.0970.010
0.4630.015 0.3340.011 0.2730.011 0.2180.012 0.1830.007 0.4330.031 0.2380.012 0.2280.008 0.1720.010 0.1650.008
0.4330.012 0.2710.011 0.2080.006 0.1680.012 0.1350.004 0.4140.029 0.2030.011 0.1580.010 0.1360.011 0.1080.007
0.0080.000 0.0080.000 0.0090.000 0.0090.000 0.0090.000 0.0210.000 0.0220.000 0.0230.001 0.0250.001 0.0270.001
2 3 4 5 6 2 3 4 5 6
0.9650.015 0.9520.012 0.9380.012 0.9290.009 0.9160.015 0.4950.248 0.3980.053 0.3120.037 0.2520.018 0.2170.042
0.4450.015 0.4640.010 0.4900.020 0.3500.009 0.3890.008 0.1370.000 0.2990.003 0.3610.011 0.2970.005 0.3580.005
0.2410.031 0.0800.023 0.0840.013 0.1010.010 0.0710.016 0.5320.000 0.3660.015 0.3650.010 0.4000.007 0.3710.013
0.3980.018 0.2660.017 0.1660.011 0.0700.020 0.0530.004 0.4850.281 0.3370.067 0.2270.028 0.1540.019 0.1170.024
0.5140.017 0.4380.017 0.3460.010 0.2140.023 0.2090.006 0.4260.275 0.3630.049 0.2950.041 0.2510.024 0.2080.042
0.4350.018 0.3080.015 0.1990.008 0.0970.021 0.0770.005 0.4340.265 0.3230.053 0.2300.031 0.1760.016 0.1340.030
0.0080.000 0.0080.000 0.0080.000 0.0090.000 0.0090.000 0.0040.000 0.0110.000 0.0170.000 0.0190.000 0.0190.000
↑ indicates that a higher value is better. Each cell reports meanstd , where the subscript denotes the standard deviation over 10 repeated runs.
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
H
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Technique Descriptions Used for FASTopic
Table 19: Technique descriptions (from MITRE ATT&CK) used to construct campaign-level FASTopic documents. Each singleAPT campaign is represented by concatenating the descriptions of all techniques appearing in its technique sequence. Technique
Description
T1003
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration. Adversaries may try to gather information about registered local system services. Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). Adversaries may attempt to identify the primary user, currently logged-in user, set of users that commonly use a system, or whether a user is actively using the system. Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. Renamed from ATT&CK to be consistent with at, launchd, cron siblings; name as is looks like parent. Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. Adversaries may attempt to get information about running processes on a system. Adversaries may abuse PowerShell commands and scripts for execution. Adversaries may abuse the Windows command shell for execution. Adversaries may attempt to find local system groups and permission settings. Adversaries may attempt to find domain-level groups and permission settings. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Adversaries may communicate using application layer protocols associated with web traffic to avoid detection or network filtering by blending in with existing traffic. Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1003.001 T1003.002 T1003.003
T1005 T1007 T1016 T1018 T1021.001 T1033 T1036.003 T1036.004 T1037.001 T1040 T1046 T1047 T1049 T1053.005 T1055.001 T1055.002 T1057 T1059.001 T1059.003 T1069.001 T1069.002 T1070.005 T1071.001 T1074.001 T1078.001
Continued on next page
TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Technique
Description
T1082
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may attempt to get a listing of local system accounts. Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Session is initiated by the client, and may be a custom protocol which is why it is related to generic network traffic instead of file transfer network traffic. Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or aid persistence and execution. Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Adversaries may collect data stored in the clipboard from users copying information within or between applications. Once established within a system or network, an adversary may use automated techniques for collecting internal data. Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. An adversary can leverage a computer’s peripheral devices. An adversary may gather the system time and/or time zone settings from a local or remote system. An adversary can leverage a computer’s peripheral devices. Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Adversaries may leverage Microsoft Office-based applications for persistence between startups. Adversaries may abuse the Microsoft Office “Office Test” Registry key to obtain persistence on a compromised system. Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. An adversary may rely upon a user opening a malicious file in order to gain execution. Adversaries may enumerate information about browsers to learn more about compromised environments. An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain or forest environments. Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
T1083 T1087.001 T1090.001 T1105 T1112 T1113 T1115 T1119 T1120 T1123 T1124 T1125 T1135
T1137 T1137.002 T1201 T1204.002 T1217 T1219 T1482 T1486 T1490 T1491 T1496 T1497.001 T1499 T1518 T1518.001 T1531
Continued on next page
CCS ’26, November 15–19, 2026, The World Forum, The Hague, The Netherlands
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and Meng Chang Chen
Technique
Description
T1546.013
Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation. Adversaries may bypass UAC mechanisms to elevate process privileges on a system. Adversaries may search the Registry on compromised systems for insecurely stored credentials. An adversary may compress and/or encrypt data that is collected prior to exfiltration. Adversaries may modify and/or disable security tools to avoid possible detection of their malware, tools, and activities. Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Adversaries may set files and directories to be hidden to evade detection mechanisms. Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs.
T1547 T1547.001 T1547.004 T1547.009 T1547.010 T1548.002 T1552.002 T1560 T1562.001 T1562.002 T1562.004 T1564 T1564.001 T1564.003 T1564.004 T1566.001 T1574.001