skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

correlating-threat-campaigns

Correlates incidents, IOCs, and TTPs across events to attribute unified threat campaigns.

954|172|Updated Mar 13, 2026
Search Tags:#attribution#threat intelligence#ioc#stix#mitre att&ck#misp#campaign correlation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill correlating-threat-campaigns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: correlating-threat-campaigns
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/correlating-threat-campaigns
Command: npx skills add https://github.com/xalgord/xalgorix --skill correlating-threat-campaigns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams often see isolated incidents without realizing they belong to a single coordinated adversary campaign. This Skill links disparate events, indicators, and behaviors across time and organizations so analysts can attribute activity to common threat actors and produce campaign-level intelligence instead of fragmented alerts.

Core Features & Use Cases

  • Multi-Dimensional Pivot Analysis: Correlates events across infrastructure, capability, temporal, and victimology dimensions using STIX 2.1 normalized data.
  • Weighted Confidence Scoring: Applies a scoring model (infrastructure 40, capability 35, temporal 15, victimology 10) to classify campaign attribution as HIGH, MEDIUM, or LOW confidence.
  • Campaign Graph & Reporting: Builds STIX campaign graphs in OpenCTI, Maltego, or Neo4j and produces structured reports with timelines, ATT&CK heatmaps, shared IOCs, and Sigma/YARA detection guidance.
  • Use Case: An ISAC partner shares indicators matching your historical SIEM events; use this Skill to pivot across shared C2 infrastructure and malware configs, score the linkage, and publish a campaign report linking months of activity to one intrusion set.

Quick Start

Correlate these three MISP events sharing the same C2 subnet and Cobalt Strike config, score the campaign confidence, and draft a STIX campaign report with shared indicators.

Frequently Asked Questions about correlating-threat-campaigns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I correlate security incidents into a threat campaign?▼

Normalize events to STIX 2.1, then pivot across four dimensions: shared infrastructure, malware capability, temporal clustering, and victimology. Score the overlap with a weighted model and build a campaign graph linking intrusion sets, malware, and indicators.

What tools are used for threat campaign correlation?▼

The workflow uses the MISP correlation engine for automatic indicator matching, OpenCTI or Maltego for relationship graphing, and Neo4j with Cypher queries for large-scale correlation across millions of events.

How is campaign attribution confidence calculated?▼

A weighted score combines infrastructure overlap (40 points), capability/TTP overlap (35), temporal clustering (15), and victimology alignment (10). Scores of 70 or above indicate HIGH confidence, 45-69 MEDIUM, and below that LOW.

Why does shared IP infrastructure cause false campaign attribution?▼

CDNs like Cloudflare and shared hosting providers serve many unrelated threat actors, so a shared IP alone is weak evidence. Require a second independent pivot such as a TLS certificate serial, JARM hash, or unique malware config before merging events.

When should I not attribute incidents to a named threat actor?▼

Avoid named attribution when confidence is below HIGH or when linkage rests on a single pivot like stock Cobalt Strike configs. Publish results as a STIX Intrusion Set instead, and validate by re-running correlation with the strongest pivot removed.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-intelligence-feeds

Normalize threat intelligence feeds into STIX 2.1 indicators.

Community
Advanced
UnitOneAIUnitOneAI
44

detection-engineering

Generate Sigma detection rules and Palantir ADS documentation for MITRE ATT&CK v16 techniques.

Official
Advanced
AxxxxxxaaannAxxxxxxaaann

building-adversary-infrastructure-tracking-system

Map threat actor infrastructure from passive DNS, WHOIS, and certificate data.

Community
Advanced
OpenCovenOpenCoven
20

ray-data

Process large-scale machine learning datasets with distributed Ray Data execution.

Official
Advanced