threat-actor-profiling

Files (1)

• SKILL.md

SKILL.md (first lines)

# Threat Actor Profiling Skill

Generate structured, actionable threat actor profiles following a deliverable-first methodology grounded in the 5W1H framework and the Diamond Model of Intrusion Analysis.

## When to Use

- User asks to profile or research a threat actor / APT group
- User needs to produce an intelligence deliverable about an adversary
- User wants to structure existing threat data into a TA profile
- User is responding to an RFI or incident involving a known threat actor
- User wants to assess capability, intent, or victimology of a group

## Core Workflow

Follow these six steps in order. Each step builds toward a complete profile.

### Step 1: Define Scope and Purpose

Before collecting any data, clarify:

1. **Profile type**: Is this for continuous internal tracking or an incident-driven analytical deliverable?
2. **Audience**: Who will consume this? (CTI team, SOC, IR, executives, legal, comms)
3. **Trigger**: Is this RFI-driven, incident-driven, or proactive tracking?

Use this decision matrix:

| Purpose | Audience | Focus | Risk to Avoid |
|---|---|---|---|
| Internal tracking | CTI, SOC, IR | Structured IOCs and TTPs, minimal narrative | Building a library nobody uses |
| Analytical deliverable | Management, Legal, Comms, IR | Timelines, impact analysis, recommendations | Unfocused data collection |

### Step 2: Collect Data Sources

Gather from two categories:

**Internal telemetry** (if incident-related):
- SIEM logs
- EDR/XDR alerts
- IAM / Active Directory events
- NDR and NetFlow data
- Cloud control plane and SaaS logs
- Honeypot data
- Vulnerability management systems

**External intelligence**:
- TIPs (OpenCTI, ThreatConnect, CrowdStrike Falcon, etc.)
- Content aggregators (Recorded Future, Feedly, Inoreader)
- OSINT tools (VirusTotal, urlscan.io, any.run, Shodan, Censys, abuse.ch)
- Sharing communities (ISACs, FIRST, bilateral partners)

**Evaluate source quality** using the Admiralty Code:
- Source Reliability: A (completely reliable) through F (cannot be judged)
- Information Credibility: 1 (confirmed) through 6 (cannot be judged)

Assign a letter-number pair to each source (e.g., B2 = usually reliable, probably true).

### Step 3: Apply 5W1H and the Diamond Model

Structure the profile using these sections:

#### 3a. Identity and Attribution (WHO)
- **Group name and aliases**: Primary name, community aliases, sub-groups, known rebrands. Use a single internal identifier.
- **Type of actor**: Cybercrime, state-sponsored, hacktivist, ransomware affiliate, etc.

#### 3b. Motive and Objective (WHY)
- **Motive**: Financial gain, political/ideological, thrill-seeking
- **Objective**: Data theft, disruption, unauthorized access, espionage, extortion

#### 3c. Victimology (WHO is targeted)
- **Sector and industry mapping**: Use NACE or NAICS codes if formal classification is needed
- **Geographic targeting**: Regions, nations, geopolitical alignment
- **Technology stack profiling**: Targeted software, unpatched systems, specific platforms
- **Intent toward your organization**: Direct, Competitors, Industry, Opportunistic

#### 3d. Capability Assessment (HOW capable)

Use a three-level scale:

| Level | Description | Tooling | Resources | Examples |
|---|---|---|---|---|
| High | Nation-state backed, highly skilled | Custom tooling, zero-days, long dwell time | Extensive/unlimited funding | APT28, Lazarus |
| Moderate | Skilled, no direct state sponsorship | Mix of open-source and limited custom tools | Substantial but unclear funding | FIN7, Wizard Spider |
| Low | Basic attacks, script-level | Commodity/public tools only | Minimal | Hacktivists, script kiddies |

Optionally use five levels (High, Medium-High, Moderate, Medium-Low, Low) for more granular assessment.

#### 3e. Modus Operandi (HOW they operate)
- **Known campaigns**: High-level description of major operations
- **Key TTPs mapped to MITRE ATT&CK**:
  - Initial access vectors
  - Lateral movement methods
  - Post-exploitation behaviors
  - Data exfiltration methods
- **Common tools and malware families**
- **Operational infrastructure**: Hosting patterns, preferred providers, regions
- **Extortion and negotiation tactics** (if applicable): Leak sites, communication style, ransom range, flexibility

#### 3f. Activity Timeline (WHEN)
- **Historical timeline**: Past campaigns and major events (prioritize those relevant to your org/industry)
- **During incident**: Living timeline with daily updates, behavior changes, and source references

#### 3g. Technical Evidence (Appendices)
In STIX 2.1 format where possible:
- **Atomic indicators**: IPs, domains, URLs, email addresses, file hashes, Bitcoin wallets
- **Tooling catalog**: Malware families with descriptions

### Step 4: Provide Analysis (What Next, So What, Now What)

This step is required for analytical deliverables. Skip for internal tracking profiles.

**Forecast (What Next?)**
- Will they escalate?
- Likely pivot targets?
- Data leak probability?
- Timeframe estimates

**Implications (So What?)**
- Impact on core business functions
- Operational disruption potential

From tsale/awesome-dfir-skills, Apache-2.0.

More from tsale/awesome-dfir-skills