skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

building-threat-actor-profile-from-osint

Builds STIX 2.1 threat actor profiles from OSINT sources with ATT&CK TTP mapping.

954|172|Updated Mar 13, 2026
Search Tags:#attribution#threat intelligence#osint#mitre att&ck#threat actor profiling#spiderfoot#stix2
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill building-threat-actor-profile-from-osint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: building-threat-actor-profile-from-osint
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/building-threat-actor-profile-from-osint
Command: npx skills add https://github.com/xalgord/xalgorix --skill building-threat-actor-profile-from-osint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires shodan, requests, beautifulsoup4, maltego-trx, stix2, attackcti.

What problem does it solve?

Analysts tracking adversaries must manually gather scattered intelligence from vendor reports, threat feeds, and infrastructure data, then reconcile conflicting aliases and attribution claims into a usable profile. This Skill automates that collection, correlation, and structuring workflow.

Core Features & Use Cases

  • Multi-source OSINT collection: Query AlienVault OTX pulses, VirusTotal collections, and Shodan host data to gather indicators and reports about a named threat actor.
  • Structured STIX 2.1 profiling: Create Threat Actor, Intrusion Set, and Identity objects with proper attribution relationships and confidence handling.
  • ATT&CK TTP mapping: Pull techniques used by a group (e.g., G0016 for APT29) via attackcti and organize them by tactic.
  • Use Case: An analyst researching APT29 runs the workflow to collect OTX pulses, enrich IPs with Shodan, map TTPs to ATT&CK, and produce a Markdown dossier with attribution confidence and detection recommendations.

Quick Start

Build a threat actor profile for APT29 by collecting OSINT from AlienVault OTX and Shodan, mapping its TTPs to MITRE ATT&CK, and generating a STIX bundle and Markdown dossier.

Frequently Asked Questions about building-threat-actor-profile-from-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a threat actor profile from OSINT?▼

Collect intelligence from sources like AlienVault OTX pulses, VirusTotal collections, and vendor reports, then structure the results as STIX 2.1 Threat Actor and Intrusion Set objects. Map TTPs to MITRE ATT&CK and generate a dossier with attribution confidence levels.

What tools are used for threat actor infrastructure mapping?▼

The workflow uses SpiderFoot for automated reconnaissance against domains and IPs, Shodan for host enrichment (ports, ASN, hostnames), and Maltego for link analysis. Passive DNS and certificate transparency data help track infrastructure over time.

What is the difference between a STIX Threat Actor and Intrusion Set?▼

An Intrusion Set models observed activity (a set of behaviors), while a Threat Actor represents the suspected entity behind it. Best practice is to model activity as an intrusion-set, link it to a threat-actor via an attributed-to relationship, and keep confidence low until corroborated.

How do I map a threat group's TTPs to MITRE ATT&CK in Python?▼

Use the attackcti library's attack_client to call get_techniques_used_by_group with the group's ATT&CK ID (e.g., G0016 for APT29). Extract technique IDs from external_references and organize them by kill chain phase.

What API keys are required for OSINT threat actor profiling?▼

The collection scripts require API keys for Shodan, VirusTotal, and AlienVault OTX, with PassiveTotal/RiskIQ listed as optional. Python 3.9+ with shodan, requests, stix2, and maltego-trx libraries is also needed.

Why is threat actor attribution often unreliable?▼

Shared infrastructure like bulletproof hosts and recycled VPS, plus reused tooling, does not prove a single actor. Apply Analysis of Competing Hypotheses and set numeric confidence values per STIX rather than asserting high confidence from one source.

Related Skills

Explore More Software Engineering Skills→
noname300989noname300989

threat-intel

Scrape authoritative web sources for live CVEs, exploits, and threat intelligence.

Community
Advanced
brucesongsbrucesongs
60

threat-hunting

Convert hunt hypotheses into Sigma-based detections with MITRE ATT&CK mappings.

Community
Advanced
zli5460zli5460
2

domain-intel

Perform passive OSINT domain analysis using DNS, WHOIS, SSL, and certificate transparency logs.

Community
Basic
daemon-blockint-techdaemon-blockint-tech
7

cti-analyst

Vet and package cyber threat intelligence with STIX/TAXII exports and ATT&CK mappings.

Community
Advanced