| name | correlating-threat-campaigns |
| description | Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
|
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["campaign-analysis","correlation","MISP","ATT&CK","threat-actor","intrusion-set","clustering","CTI"] |
| version | 1.0.0 |
| author | team-cybersecurity |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
Correlating Threat Campaigns
When to Use
Use this skill when:
- Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs)
- An ISAC partner shares indicators from an incident that match your own historical events
- Building a campaign report linking adversary activity over weeks or months to a single operation
Do not use this skill to force correlation based on weak signals — false campaign attribution misleads defenders and wastes resources on incorrect threat models.
Detection Gaps & Validation
- Shared-infrastructure false attribution: a common Cloudflare/AWS CloudFront IP or a recycled bulletproof host links unrelated actors. Require a second independent pivot (TLS cert serial, JARM hash, malware config) before merging events into one campaign.
- Capability conflation: Cobalt Strike, Sliver, and Metasploit are shared across many actors. A default beacon watermark or stock profile is weak evidence - confirm with a unique malleable C2 profile field or staging key.
- Temporal blind spots: events spanning multiple years may share infrastructure reassigned to a different operator. Check WHOIS/passive-DNS first-seen ranges, not just that the value matches.
- Confidence scoring discipline: treat the weighted score (infra 40 / capability 35 / temporal 15 / victim 10) as a hypothesis, not proof. Anything below HIGH should ship as a STIX
Intrusion Set, not a named Threat Actor attribution.
- How to validate (avoid over-attribution): before publishing, re-run the correlation with the single strongest pivot removed - if the campaign collapses, the linkage rested on one weak signal. Label every STIX
Relationship with its evidence reference and confidence.
Prerequisites
- TIP or SIEM with historical indicator and event data (90+ days recommended)
- MISP correlation engine enabled with event sharing configured
- Graph analysis tool (Maltego, Neo4j, or OpenCTI) for relationship visualization
- Reference to MITRE ATT&CK intrusion set and campaign objects for structuring output
Workflow
Step 1: Collect and Normalize Events
Gather all candidate events for correlation from:
- Internal SIEM (raw events, alert history)
- TIP (historical indicators and events)
- ISAC sharing (partner-submitted events in MISP or TAXII)
- Commercial intelligence (Recorded Future, Mandiant, CrowdStrike reports)
Normalize all events to STIX 2.1 schema with consistent timestamp (UTC), indicator types, and confidence scores. Ensure all indicators have source attribution and collection date.
