Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attr
يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
SKILL.md
تعليمات المصدر · معاينة للقراءة فقط
name
analyzing-campaign-attribution-evidence
description
Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attr
Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.
When to Use
When investigating security incidents that require analyzing campaign attribution evidence
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Detection Gaps & Validation
Most attribution errors come from treating shared resources as unique fingerprints. Watch these gaps:
Shared-infra false attribution: Cobalt Strike default profiles, bulletproof-hosting ASNs, and Let's Encrypt certs are reused across unrelated actors. A shared C2 IP adds +30 in the overlap model but proves co-tenancy, not common authorship; require >=2 independent categories before raising confidence.
False flags: planted PDB paths, foreign-language strings, and borrowed TTPs are deliberate deception. Treat single-category language/timezone artifacts as neutral in the ACH matrix, never consistent.
Stale TTP profiles:attackcti group-to-technique mappings lag real activity; a low Jaccard score may reflect outdated ATT&CK group data, not a different actor.
To validate the analysis works: seed the ACH matrix with a known-good campaign and confirm the true actor ranks first; verify inconsistent evidence is weighted (-2x) so a single contradiction demotes a hypothesis. Re-run rank_hypotheses() after removing the single strongest evidence item -- if the top actor does not change, attribution rests on one point and should be downgraded to MODERATE/LOW. Document at least one competing hypothesis and an explicit false-flag check for every HIGH assessment.
Prerequisites
Python 3.9+ with attackcti, stix2, networkx libraries
Access to threat intelligence platforms (MISP, OpenCTI)
Understanding of Diamond Model of Intrusion Analysis
Familiarity with MITRE ATT&CK threat group profiles
Knowledge of malware analysis and infrastructure tracking techniques
Key Concepts
Attribution Evidence Categories
Infrastructure Overlap: Shared C2 servers, domains, IP ranges, hosting providers
TTP Consistency: Matching ATT&CK techniques and sub-techniques across campaigns
Operational Patterns: Timing (working hours, time zones), targeting patterns, operational tempo
Language Artifacts: Embedded strings, variable names, error messages in specific languages
Victimology: Target sector, geography, and organizational profile consistency
Confidence Levels
High Confidence: Multiple independent evidence categories converge on same actor
Moderate Confidence: Several evidence categories match, some ambiguity remains
Low Confidence: Limited evidence, possible false flags or shared tooling
Analysis of Competing Hypotheses (ACH)
Structured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.
