correlating-threat-campaigns

name	correlating-threat-campaigns
description	Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products.
domain	cybersecurity
tags	["campaign-analysis","correlation","MISP","ATT&CK","threat-actor","intrusion-set","clustering","CTI"]
subdomain	threat-intelligence
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Correlating Threat Campaigns

Overview

Cybersecurity skill for correlating threat campaigns. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "correlating threat campaigns"
• "Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash"
• "An ISAC partner shares indicators from an incident that match your own historica"
• "Building a campaign report linking adversary activity over weeks or months to a"

Use this skill when:

• Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs)
• An ISAC partner shares indicators from an incident that match your own historical events
• Building a campaign report linking adversary activity over weeks or months to a single operation

Do not use this skill to force correlation based on weak signals — false campaign attribution misleads defenders and wastes resources on incorrect threat models.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• TIP or SIEM with historical indicator and event data (90+ days recommended)
• MISP correlation engine enabled with event sharing configured
• Graph analysis tool (Maltego, Neo4j, or OpenCTI) for relationship visualization
• Reference to MITRE ATT&CK intrusion set and campaign objects for structuring output

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}