The Pipeline

• Detonate: run the sample in the safe lab.
• Capture: collect events, diffs, and packets.
• Score: apply weighted behavioral rules.
• Report: emit a verdict, IOCs, and ATT&CK mapping.