A cascaded probabilistic framework for stealth-aware MITRE ATT&CK path prediction in active directory adversary emulation

Abstract Proactive adversary emulation requires anticipating multi-step attack trajectories, yet existing approaches rely on static attack graphs or single-signal models that cannot jointly satisfy coherence, tactical realism, and evasiveness. We propose a cascaded probabilistic framework for MITRE ATT&CK technique-path prediction in Active Directory environments, where exhaustive enumeration is intractable. Its contribution is a three-stage architecture that decouples these objectives instead of blending them. Stage 1, a two-layer unidirectional LSTM trained on observed threat-actor chains, emits a five-candidate pool rather than one technique. Stage 2, an empirical Markov tactic-transition gate, admits only attested transitions, including self-loops and backward moves a strict linear kill chain excludes. Stage 3 re-ranks survivors against a detection-rule corpus, favoring evasive over merely probable techniques. Candidates are masked at inference to Windows-applicable techniques, so outputs are technique chains, not instantiated paths. Under a prefix-disjoint protocol in which no evaluation context occurs in training, the true continuation is retained in the five-candidate pool more often than by a first-order predictor or an exact prefix-lookup table on identical pairs. Because Stage 3 both selects on and is scored by detection-rule density, the chains are re-scored against independently maintained corpora the selector never accesses; the exposure reduction persists there, and it is that transferred result that carries the evasiveness claim. Novel here is that structural admissibility is a hard constraint rather than a soft weight, so tactical realism cannot be traded away for likelihood or stealth. A case study initiated from a single initial-access technique further indicates that all tactic transitions within the returned path portfolio have attested support in the corpus transition matrix, and that no predicted step violates the ATT&CK-declared phase set of its technique.