correlating-threat-campaigns

name	correlating-threat-campaigns
description	Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
domain	cybersecurity
subdomain	threat-intelligence
tags	["campaign-analysis","correlation","MISP","ATT&CK","threat-actor","intrusion-set","clustering","CTI"]
version	1.0.0
author	team-cybersecurity
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Correlating Threat Campaigns

When to Use

Use this skill when:

• Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs)
• An ISAC partner shares indicators from an incident that match your own historical events
• Building a campaign report linking adversary activity over weeks or months to a single operation

Do not use this skill to force correlation based on weak signals — false campaign attribution misleads defenders and wastes resources on incorrect threat models.

Prerequisites

• TIP or SIEM with historical indicator and event data (90+ days recommended)
• MISP correlation engine enabled with event sharing configured
• Graph analysis tool (Maltego, Neo4j, or OpenCTI) for relationship visualization
• Reference to MITRE ATT&CK intrusion set and campaign objects for structuring output

Workflow

Step 1: Collect and Normalize Events

Gather all candidate events for correlation from:

• Internal SIEM (raw events, alert history)
• TIP (historical indicators and events)
• ISAC sharing (partner-submitted events in MISP or TAXII)
• Commercial intelligence (Recorded Future, Mandiant, CrowdStrike reports)

Normalize all events to STIX 2.1 schema with consistent timestamp (UTC), indicator types, and confidence scores. Ensure all indicators have source attribution and collection date.

Step 2: Identify Correlation Pivot Points

Apply systematic pivot analysis across four dimensions:

Infrastructure pivots:

• Same IP address or /24 subnet across events
• Same domain registrant email or WHOIS organization
• Same ASN or hosting provider with same account fingerprint
• Same SSL certificate fingerprint or serial number across C2 domains

Capability pivots:

• Same malware hash or YARA signature match
• Same C2 communication protocol (Cobalt Strike beacon config, Sliver implant parameters)
• Same exploit code or weaponized document template
• Same obfuscation method or packer fingerprint

Temporal pivots:

• Events occurring within same time window (operational hours suggesting same timezone)
• Sequential events with logical kill chain progression
• Malware compilation timestamps clustering in same date range

Victimology pivots:

• Same target sector (healthcare, energy, financial)