Build IcedID threat-model and detection-resilience research pipeline

[LLR6]

This PR upgrades LR-PayloadLab into a reproducible threat-model and detection-resilience research project.

What is included

1. Synthetic detection-evasion benchmark

• P1/P2/P3 feature-space perturbation profiles
• TP/FN/FP/TN, Recall and FPR
• recall delta vs baseline
• feature sensitivity and decision-flip analysis
• deterministic seeds and automated tests

2. Real threat model: IcedID (MITRE ATT&CK S0483)

• 12 selected IcedID ATT&CK behaviors
• structured case-study manifest
• tactic-oriented coverage analysis
• documentation for research presentation

3. IcedID × Atomic Red Team coverage matrix

• 11 exact same-ID Atomic Red Team YAML mappings
• T1497 explicitly marked as having no exact parent-level Atomic mapping
• high-risk techniques retained as metadata-only instead of wrapping execution
• isolated-lab classification for lower-risk research mappings
• evidence-oriented experiment result schema

4. Honest experiment pipeline

• all lab results default to not_run / not_evaluated
• no fabricated detection claims
• result template records run status, detection status, telemetry, evidence and notes
• matrix generator exports Markdown and JSON reports

Research workflow

IcedID threat model
→ MITRE ATT&CK behavior mapping
→ Atomic Red Team metadata
→ authorized isolated lab execution
→ telemetry evidence
→ detection coverage / misses
→ detector robustness analysis

Safety boundary

The repository does not ship IcedID malware binaries and does not implement production AV/EDR bypass, credential theft, covert C2, persistence payloads, or a one-click wrapper for high-risk Atomic tests.

GitHub Actions tests pass on the current PR head.