profiling-threat-actor-groups

Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.

インストールへ移動

リポジトリ: mukul975/Anthropic-Cybersecurity-Skills
ソースの最終更新活動: 2026年6月1日 10:13
検出された SKILL.md の言語: 英語
スター: 27,732
フォーク: 3,366

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill profiling-threat-actor-groups

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

ファイルエクスプローラー

4 ファイル

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

このリポジトリのすべてを見る

name	profiling-threat-actor-groups
description	Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.
domain	cybersecurity
subdomain	threat-intelligence
tags	["MITRE-ATT&CK","threat-actor","APT","CrowdStrike","Mandiant","attribution","kill-chain","NIST-CSF"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1591","T1592","T1593","T1589","T1566"]

Profiling Threat Actor Groups

When to Use

Use this skill when:

Updating the organization's threat model with profiles of adversary groups recently observed targeting your sector
Preparing an executive briefing on APT groups that align with geopolitical events affecting your business
Enabling SOC analysts to understand attacker objectives and TTPs to improve detection tuning

Do not use this skill for real-time incident attribution — attribution during active incidents should be deprioritized in favor of containment. Profile refinement occurs post-incident.

Prerequisites

Access to MITRE ATT&CK Groups database (https://attack.mitre.org/groups/)
Commercial threat intelligence subscription (Mandiant Advantage, CrowdStrike Falcon Intelligence, or Recorded Future)
Sector-specific ISAC membership for targeted intelligence (FS-ISAC, H-ISAC, E-ISAC)
Structured profile template (see workflow below)

Workflow

Step 1: Identify Relevant Threat Actors

Cross-reference your organization's sector, geography, and technology stack against known adversary targeting patterns. Sources:

MITRE ATT&CK Groups: 130+ documented nation-state and criminal groups with TTP mappings
CrowdStrike Annual Threat Report: adversary naming by nation-state (BEAR=Russia, PANDA=China, KITTEN=Iran, CHOLLIMA=North Korea)
Mandiant M-Trends: annual report with sector-specific targeting statistics
CISA Known Exploited Vulnerabilities (KEV) catalog: identifies vulnerabilities actively exploited by specific threat actors

Shortlist 5–10 groups most likely to target your organization based on sector alignment and recent activity.

Step 2: Collect Profile Data

For each adversary, document across standard dimensions:

Identity: ATT&CK Group ID (e.g., G0016 for APT29), aliases (Cozy Bear, The Dukes, Midnight Blizzard), suspected nation-state sponsor

Motivations: Espionage, financial gain, disruption, intellectual property theft

Targeting: Sectors, geographies, organization sizes, technology targets (OT/IT, cloud, supply chain)

Capabilities: Custom malware (e.g., APT29's SUNBURST, MiniDuke), exploitation of 0-days vs. known CVEs, supply chain attack capability

Campaign History: Notable operations with dates (SolarWinds 2020, Exchange Server 2021, etc.)

TTPs by ATT&CK Phase: Document top 5 techniques per tactic phase

Term	Definition
APT	Advanced Persistent Threat — well-resourced, sophisticated adversary (typically nation-state or sophisticated criminal) conducting long-term targeted operations
TTPs	Tactics, Techniques, Procedures — behavioral fingerprint of an adversary group, more durable than IOCs which change frequently
Aliases	Threat actors receive different names from different vendors (APT29 = Cozy Bear = The Dukes = Midnight Blizzard = YTTRIUM)
Attribution	Process of associating an attack with a specific threat actor; requires multiple independent corroborating data points and carries inherent uncertainty
Cluster	A group of related intrusion activity that may or may not be attributable to a single actor; used when attribution is uncertain
Intrusion Set	STIX SDO type representing a grouped set of adversarial behaviors with common objectives, even if actor identity is unknown

profiling-threat-actor-groups

インストール方法

ソースファイルを確認

Profiling Threat Actor Groups

When to Use

Prerequisites

Workflow

Step 1: Identify Relevant Threat Actors

Step 2: Collect Profile Data

Step 3: Map TTPs to ATT&CK

Profiling Threat Actor Groups

When to Use

Prerequisites

Workflow

Step 1: Identify Relevant Threat Actors

Step 2: Collect Profile Data

Step 3: Map TTPs to ATT&CK

Step 4: Assess Detection Coverage Against Profile

Step 5: Package Profile for Distribution

Key Concepts

Tools & Systems

Common Pitfalls

profiling-threat-actor-groups

ソース情報

インストール方法

ソースファイルを確認

このリポジトリの他の Skills

このリポジトリの他の Skills

Profiling Threat Actor Groups

When to Use

Prerequisites

Workflow

Step 1: Identify Relevant Threat Actors

Step 2: Collect Profile Data

Step 3: Map TTPs to ATT&CK

Profiling Threat Actor Groups

When to Use

Prerequisites

Workflow

Step 1: Identify Relevant Threat Actors

Step 2: Collect Profile Data

Step 3: Map TTPs to ATT&CK

Step 4: Assess Detection Coverage Against Profile

Step 5: Package Profile for Distribution

Key Concepts

Tools & Systems

Common Pitfalls