What it does. Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/analyzing-campaign-attribution-evidence/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-campaign-attribution-evidence, or copy the skill folder into ~/.claude/skills/analyzing-campaign-attribution-evidence/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-campaign-attribution-evidence/SKILL.md

SKILL.md (verbatim)

name: analyzing-campaign-attribution-evidence
description: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
domain: cybersecurity
subdomain: threat-intelligence
tags:
- threat-intelligence
- cti
- ioc
- mitre-attack
- stix
- attribution
- campaign-analysis
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1587.001
- T1583.001
- T1588.002
- T1071.001

Analyzing Campaign Attribution Evidence

Overview

Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.

When to Use

• When investigating security incidents that require analyzing campaign attribution evidence
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with attackcti, stix2, networkx libraries
• Access to threat intelligence platforms (MISP, OpenCTI)
• Understanding of Diamond Model of Intrusion Analysis
• Familiarity with MITRE ATT&CK threat group profiles
• Knowledge of malware analysis and infrastructure tracking techniques

Key Concepts

Attribution Evidence Categories

1. Infrastructure Overlap: Shared C2 servers, domains, IP ranges, hosting providers
2. TTP Consistency: Matching ATT&CK techniques and sub-techniques across campaigns
3. Malware Code Similarity: Shared code bases, compilers, PDB paths, encryption routines
4. Operational Patterns: Timing (working hours, time zones), targeting patterns, operational tempo
5. Language Artifacts: Embedded strings, variable names, error messages in specific languages
6. Victimology: Target sector, geography, and organizational profile consistency

Confidence Levels

• High Confidence: Multiple independent evidence categories converge on same actor
• Moderate Confidence: Several evidence categories match, some ambiguity remains
• Low Confidence: Limited evidence, possible false flags or shared tooling

Analysis of Competing Hypotheses (ACH)

Structured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.

Workflow

Step 1: Collect Attribution Evidence

from stix2 import MemoryStore, Filter
from collections import defaultdict

class AttributionAnalyzer:
    def __init__(self):
        self.evidence = []
        self.hypotheses = {}

    def add_evidence(self, category, description, value, confidence):
        self.evidence.append({
            "category": category,
            "description": description,
            "value": value,
            "confidence": confidence,
            "timestamp": None,
        })

    def add_hypothesis(self, actor_name, actor_id=""):
        self.hypotheses[actor_name] = {
            "actor_id": actor_id,
            "consistent_evidence": [],
            "inconsistent_evidence": [],
            "neutral_evidence": [],
            "score": 0,
        }

    def evaluate_evidence(self, evidence_idx, actor_name, assessment):
        """Assess evidence against a hypothesis: consistent/inconsistent/neutral."""
        if assessment == "consistent":
            self.hypotheses[actor_name]["consistent_evidence"].append(evidence_idx)
            self.hypotheses[actor_name]["score"] += self.evidence[evidence_idx]["confidence"]
        elif assessment == "inconsistent":
            self.hypotheses[actor_name]["inconsistent_evidence"].append(evidence_idx)
            self.hypotheses[actor_name]["score"] -= self.evidence[evidence_idx]["confidence"] * 2
        else:
            self.hypotheses[actor_name]["neutral_evidence"].append(evidence_idx)

    def rank_hypotheses(self):
        """Rank hypotheses by attribution score."""
        ranked = sorted(
            self.hypotheses.items(),
            key=lambda x: x[1]["score"],
            reverse=True,
        )
        return [
            {
                "actor": name,
                "score": data["score"],
                "consistent": len(data["consistent_evidence"]),
                "inconsistent": len(data["inconsistent_evidence"]),
                "confidence": self._score_to_confidence(data["score"]),
            }
            for name, data in ranked
        ]

    def _score_to_confidence(self, score):
        if score >= 80:
            return "HIGH"
        elif score >= 40:
            return "MODERATE"
        else:
            return "LOW"

Step 2: Infrastructure Overlap Analysis

def analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):
    """Compare infrastructure between two campaigns for attribution."""
    overlap = {
        "shared_ips": set(campaign_a_infra.get("ips", [])).intersection(
            campaign_b_infra.get("ips", [])
        ),
        "shared_domains": set(campaign_a_infra.get("domains", [])).intersection(
            campaign_b_infra.get("domains", [])
        ),
        "shared_asns": set(campaign_a_infra.get("asns", [])).intersection(
            campaign_b_infra.get("asns", [])
        ),
        "shared_registrars": set(campaign_a_infra.get("registrars", [])).intersection(
            campaign_b_infra.get("registrars", [])
        ),
    }

    overlap_score = 0
    if overlap["shared_ips"]:
        overlap_score += 30
    if overlap["shared_domains"]:
        overlap_score += 25
    if overlap["shared_asns"]:
        overlap_score += 15
    if overlap["shared_registrars"]:
        overlap_score += 10

    return {
        "overlap": {k: list(v) for k, v in overlap.items()},
        "overlap_score": overlap_score,
        "assessment": "STRONG" if overlap_score >= 40 else "MODERATE" if overlap_score >= 20 else "WEAK",
    }

Step 3: TTP Comparison Across Campaigns

from attackcti import attack_client

def compare_campaign_ttps(campaign_techniques, known_actor_techniques):
    """Compare campaign TTPs against known threat actor profiles."""
    campaign_set = set(campaign_techniques)
    actor_set = set(known_actor_techniques)

    common = campaign_set.intersection(actor_set)
    unique_campaign = campaign_set - actor_set
    unique_actor = actor_set - campaign_set

    jaccard = len(common) / len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0

    return {
        "common_techniques": sorted(common),
        "common_count": len(common),
        "unique_to_campaign": sorted(unique_campaign),
        "unique_to_actor": sorted(unique_actor),
        "jaccard_similarity": round(jaccard, 3),
        "overlap_percentage": round(len(common) / len(campaign_set) * 100, 1) if campaign_set else 0,
    }

Step 4: Generate Attribution Report

def generate_attribution_report(analyzer):
    """Generate structured attribution assessment report."""
    rankings = analyzer.rank_hypotheses()

    report = {
        "assessment_date": "2026-02-23",
        "total_evidence_items": len(analyzer.evidence),
        "hypotheses_evaluated": len(analyzer.hypotheses),
        "rankings": rankings,
        "primary_attribution": rankings[0] if rankings else None,
        "evidence_summary": [
            {
                "index": i,
                "category": e["category"],
                "description": e["description"],
                "confidence": e["confidence"],
            }
            for i, e in enumerate(analyzer.evidence)
        ],
    }

    return report

Validation Criteria

• Evidence collection covers all six attribution categories
• ACH matrix properly evaluates evidence against competing hypotheses
• Infrastructure overlap analysis identifies shared indicators
• TTP comparison uses ATT&CK technique IDs for precision
• Attribution confidence levels are properly justified
• Report includes alternative hypotheses and false flag considerations

References

• Diamond Model of Intrusion Analysis
• MITRE ATT&CK Groups
• Analysis of Competing Hypotheses
• Threat Attribution Framework

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Campaign Attribution Analysis Report Template

Report Metadata

Field	Value
Report ID	CTI-YYYY-NNNN
Date	YYYY-MM-DD
Classification	TLP:AMBER
Analyst	[Name]
Confidence	High/Moderate/Low

Executive Summary

[Brief overview of key findings and their significance]

Key Findings

1. [Finding 1 with supporting evidence]
2. [Finding 2 with supporting evidence]
3. [Finding 3 with supporting evidence]

Detailed Analysis

Finding 1

• Evidence: [Description of evidence]
• Confidence: High/Moderate/Low
• MITRE ATT&CK: [Relevant technique IDs]
• Impact Assessment: [Potential impact to organization]

Indicators of Compromise

Type	Value	Context	Confidence

Recommendations

1. Immediate: [Actions requiring immediate attention]
2. Short-term: [Actions within 1-2 weeks]
3. Long-term: [Strategic improvements]

References

• [Source 1]
• [Source 2]

references/api-reference.md (verbatim)

API Reference: Campaign Attribution Evidence Analysis

Diamond Model of Intrusion Analysis

Four Core Features

Feature	Description	Attribution Value
Adversary	Threat actor identity	Direct attribution
Capability	Malware, exploits, tools	Indirect - shared tooling
Infrastructure	C2, domains, IPs	Strong - operational overlap
Victim	Targets, sectors, regions	Contextual - targeting pattern

Pivot Analysis

Adversary ←→ Capability ←→ Infrastructure ←→ Victim
    ↕              ↕              ↕              ↕
  (HUMINT)     (Malware DB)   (WHOIS/DNS)   (Victimology)

Analysis of Competing Hypotheses (ACH)

Matrix Format

Evidence \ Hypothesis  |  APT28  |  APT29  |  Lazarus  |  Unknown
-----------------------------------------------------------------
Infrastructure overlap  |   ++    |    -    |     -     |    N
TTP consistency        |   ++    |   ++    |     -     |    N
Malware similarity     |    +    |    -    |     -     |    N
Timing (UTC+3)         |   ++    |   ++    |     -     |    N
Language (Russian)     |   ++    |   ++    |     -     |    N

Scoring

Symbol	Meaning	Weight
++	Strongly consistent	+2
+	Consistent	+1
N	Neutral	0
-	Inconsistent	-1
--	Strongly inconsistent	-2

MITRE ATT&CK Group Queries

Python (mitreattack-python)

from mitreattack.stix20 import MitreAttackData
attack = MitreAttackData("enterprise-attack.json")
group = attack.get_group_by_alias("APT29")
techniques = attack.get_techniques_used_by_group(group.id)

STIX2 Relationship Query

from stix2 import Filter
relationships = src.query([
    Filter("type", "=", "relationship"),
    Filter("source_ref", "=", group_id),
    Filter("relationship_type", "=", "uses"),
])

Infrastructure Overlap Tools

PassiveTotal / RiskIQ

# WHOIS history
curl -u user:key "https://api.passivetotal.org/v2/whois?query=domain.com"

# Passive DNS
curl -u user:key "https://api.passivetotal.org/v2/dns/passive?query=1.2.3.4"

VirusTotal Relations

curl -H "x-apikey: KEY" \
  "https://www.virustotal.com/api/v3/domains/example.com/communicating_files"

Confidence Assessment Framework

Level	Score Range	Criteria
HIGH	0.8-1.0	Multiple independent evidence types converge
MEDIUM	0.5-0.8	Significant evidence with some gaps
LOW	0.2-0.5	Limited evidence, alternative hypotheses remain
NEGLIGIBLE	0.0-0.2	Insufficient evidence for attribution

STIX Attribution Objects

Campaign Object

{
  "type": "campaign",
  "name": "Operation DarkShadow",
  "first_seen": "2024-01-15T00:00:00Z",
  "last_seen": "2024-03-20T00:00:00Z",
  "objective": "Espionage targeting defense sector"
}

Attribution Relationship

{
  "type": "relationship",
  "relationship_type": "attributed-to",
  "source_ref": "campaign--abc123",
  "target_ref": "intrusion-set--def456",
  "confidence": 75
}

references/standards.md (verbatim)

Standards and Frameworks Reference

Applicable Standards

• STIX 2.1: Structured Threat Information eXpression for CTI data representation
• TAXII 2.1: Transport protocol for sharing CTI over HTTPS
• MITRE ATT&CK: Adversary tactics, techniques, and procedures taxonomy
• Diamond Model: Intrusion analysis framework (Adversary, Capability, Infrastructure, Victim)
• Traffic Light Protocol (TLP): Information sharing classification (CLEAR, GREEN, AMBER, RED)

MITRE ATT&CK Relevance

• Technique mapping for threat actor behavior classification
• Data sources for detection capability assessment
• Mitigation strategies linked to specific techniques

Industry Frameworks

• NIST Cybersecurity Framework (CSF) 2.0 - Identify function
• ISO 27001:2022 - A.5.7 Threat Intelligence
• FIRST Standards - TLP, CSIRT, vulnerability coordination

References

• STIX 2.1 Specification
• MITRE ATT&CK
• Diamond Model Paper
• NIST CSF 2.0

references/workflows.md (verbatim)

Campaign Attribution Analysis Workflows

Workflow 1: Collection and Analysis

[Intelligence Sources] --> [Data Collection] --> [Analysis] --> [Reporting]
        |                        |                   |               |
        v                        v                   v               v
  OSINT/HUMINT/SIGINT    Normalize/Enrich    Assess/Correlate  Disseminate

Steps:

1. Planning: Define intelligence requirements and collection priorities
2. Collection: Gather data from relevant sources
3. Processing: Normalize data formats and filter noise
4. Analysis: Apply analytical frameworks and correlate findings
5. Production: Generate intelligence products and reports
6. Dissemination: Share with stakeholders via appropriate channels
7. Feedback: Collect consumer feedback to refine future collection

Workflow 2: Continuous Monitoring

[Watchlist] --> [Automated Monitoring] --> [Change Detection] --> [Alert/Update]

Steps:

1. Define Watchlist: Identify indicators, actors, and topics to monitor
2. Configure Monitoring: Set up automated collection from relevant sources
3. Change Detection: Identify new or changed intelligence
4. Assessment: Evaluate significance of changes
5. Alerting: Notify stakeholders of significant intelligence updates
6. Archive: Store intelligence for historical analysis and trending

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.