threat-profile
Threat actor profiling for adversary emulation — APT group research, sophistication tiers, MITRE ATT&CK mapping, initial access vectors, custom archetypes.
ソース情報
- リポジトリ
- BitterSecurity/Decepticon
- ソースの最終更新活動
- 2026年6月8日 07:58
- 検出された SKILL.md の言語
- 英語
- スター
- 5,565
- フォーク
- 1,053
インストール方法
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
ソースファイルを確認
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
ファイルエクスプローラー
11 ファイルSKILL.md を表示中
SKILL.md
ソースの指示 · 読み取り専用プレビュー- name
- threat-profile
- description
- Threat actor profiling for adversary emulation — APT group research, sophistication tiers, MITRE ATT&CK mapping, initial access vectors, custom archetypes.
- allowed-tools
- Read Write Edit
- metadata
- {"subdomain":"planning","when_to_use":"threat modeling, adversary emulation, APT simulation, threat actor selection, who should we emulate, what kind of attacker","tags":"threat-modeling, apt, adversary-emulation, mitre-attack","upstream_ref":"Soundwave engagement-planning template — threat actor profiling for adversary emulation"}
# Threat Profile Builder
Threat profiling defines **who** the red team is emulating. Without a clear profile, the engagement devolves into arbitrary tool usage instead of realistic adversary simulation.
## When to Use
- During CONOPS creation when selecting a threat actor
- User asks about threat actors, APT groups, or adversary emulation
- Need to map engagement scope to realistic attacker behaviors
## Workflow
### Step 1: Determine Tier
Ask the user which tier fits. If they're unsure, recommend based on engagement type:
| Tier | Actor Type | Sophistication | Best For |
|------|-----------|---------------|----------|
| 1 | Opportunistic attacker | Low | Vulnerability assessment, external scan |
| 2 | Targeted cybercriminal | Medium | Penetration test, focused engagement |
| 3 | APT / nation-state | High | Full red team, advanced simulation |
| 4 | Insider threat | Varies | Internal assessment, assumed breach |
### Step 2: Build the Profile
Gather or derive these fields — see `references/adversary-archetypes.md` for pre-built tier profiles and `references/apt-groups.md` for known APT/eCrime group cards (now 19 actors + a MITRE Group-ID crosswalk). For a **named actor**, load the matching emulation playbook (`emulation/<actor>/SKILL.md`, indexed by `emulation/SKILL.md`) — it ships a ready-to-edit `ThreatProfile` seed **and** the full kill chain mapped to Decepticon skills:
1. **Name/Alias** — Known group or custom archetype
2. **Sophistication** — low / medium / high / nation-state
3. **Motivation** — financial, espionage, disruption, hacktivism
4. **Initial Access** — MITRE technique IDs for how they get in
5. **Key TTPs** — Top 5-10 MITRE ATT&CK techniques
6. **Tools & Infrastructure** — Realistic toolset for this actor
### Step 3: Validate Against RoE
The profile must be consistent with what the RoE allows. There's no point emulating spearphishing if social engineering isn't authorized.
| RoE Constraint | Profile Implication |
|---|---|
| External only, no social engineering | Focus on T1190, T1595, T1133 |
| Phishing authorized | Include T1566, T1598 |
| Internal assumed breach | Start from T1078 (Valid Accounts) |
| Full red team | Full kill chain TTPs |
### Step 4: Output
Generate **two** payloads:
**(a) Standalone `plan/threat-profile.json`** — full `ThreatProfile` schema:
```json
{
"engagement_name": "...",
"actor_name": "APT29-like (Cozy Bear)",
"actor_aliases": ["Cozy Bear", "The Dukes"],
"group_id": "G0050",
"tier": "tier-3",
"sophistication": "nation-state",
"motivation": "espionage",
"initial_access": ["T1195.002", "T1566.001", "T1078"],
"key_ttps": ["T1059.001", "T1053.005", "T1071.001", "T1048.003", "T1550.001"],
"tools": ["Cobalt Strike", "Mimikatz", "WMI Event Subscription"],
"infrastructure": ["Compromised SaaS", "Domain fronting via CDN"],
"recent_cti_delta": "Q1 2026 reports show shift toward OAuth abuse and CI/CD supply-chain",
"confidence": "probable"
}
```
`tier` is the StrEnum value: `"tier-1"` (opportunistic), `"tier-2"` (targeted cybercrime), `"tier-3"` (APT / nation-state), `"tier-4"` (insider). Map to `sophistication` informally — `tier-3` ↔ "nation-state", `tier-2` ↔ "high", `tier-1` ↔ "low/medium".
**(b) Embedded summary** — one-entry `threat_actors` list inside `conops.json` for backward-compat (the legacy `ThreatActor` shape: `name` + `sophistication` + `motivation` + `initial_access` + `ttps`). Skip `tier`/`group_id`/`tools`/`infrastructure` here — those live only in the standalone profile.
### Step 5: Named-actor kill chain (optional but recommended)
When the operator picked a known actor, don't hand-build the TTP sequence — load the
emulation catalog and copy the per-actor plan:
```text
load_skill("/skills/standard/soundwave/threat-profile/emulation/SKILL.md") # routing table
load_skill("/skills/standard/soundwave/threat-profile/emulation/apt29/SKILL.md") # e.g. APT29
```
Each playbook gives you (a) the `ThreatProfile` seed for `plan/threat-profile.json`, (b) the
ordered `kill_chain` to copy into `conops.json` (mapped to the 5 `ObjectivePhase` buckets),
and (c) the actor-specific RoE/safety gates to carry into `abort.json` + `deconfliction.json`.
Prune any technique the RoE forbids (Step 3) before writing. Available: `apt29`, `sandworm`,
`scattered-spider`, `volt-typhoon`, `lazarus`, `fin7`, `lockbit`.
GitHubで見る