skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

profiling-threat-actor-groups

Builds threat actor profiles by aggregating TTPs, campaign history, and attribution indicators from intelligence sources.

954|172|Updated Mar 13, 2026
Search Tags:#cybersecurity#attribution#threat intelligence#mitre att&ck#ttps#threat actor profiling#APT
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill profiling-threat-actor-groups
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: profiling-threat-actor-groups
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/profiling-threat-actor-groups
Command: npx skills add https://github.com/xalgord/xalgorix --skill profiling-threat-actor-groups

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires mitreattack-python.

What problem does it solve?

Security teams struggle to turn scattered threat intelligence into actionable adversary profiles, leading to stale threat models, misattributed activity, and detection gaps against the groups most likely to target their sector.

Core Features & Use Cases

  • Adversary Shortlisting: Cross-references your sector, geography, and tech stack against MITRE ATT&CK Groups, CrowdStrike adversary naming, and Mandiant M-Trends to identify the 5-10 most relevant threat actors.
  • Structured Profile Building: Documents identity, aliases, motivations, targeting, capabilities, campaign history, and top TTPs per ATT&CK tactic phase, with alias reconciliation across vendors.
  • Detection Gap Analysis: Maps each group's techniques against your detection coverage matrix to surface critical gaps and compensating controls.
  • Use Case: A financial services CISO needs an executive briefing on APT groups targeting the sector; the skill produces a 1-page executive summary, a SOC analyst brief with TTPs and IOCs, and a STIX technical appendix, all with confidence-qualified attribution.

Quick Start

Profile the top threat actor groups targeting the healthcare sector and map their TTPs against our current detection coverage.

Frequently Asked Questions about profiling-threat-actor-groups

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I profile a threat actor group using MITRE ATT&CK?▼

Start with the ATT&CK Groups database to find the group's ID and documented techniques, then use mitreattack-python to programmatically pull techniques used by the group. Supplement with campaign history and tooling data from Mandiant or CrowdStrike profiles.

How do I map threat actor TTPs to ATT&CK techniques in Python?▼

Use the mitreattack-python library: load enterprise-attack.json into MitreAttackData, retrieve the group by its ATT&CK ID, then call get_techniques_used_by_group to enumerate technique IDs, names, and associated tactic phases.

What is the difference between APT29, Cozy Bear, and Midnight Blizzard?▼

They are aliases for the same adversary: APT29 is the Mandiant name, Cozy Bear is CrowdStrike's, and Midnight Blizzard is Microsoft's. Vendor alias reconciliation is essential before merging profiles, since vendors split and merge clusters differently.

When should I avoid threat actor attribution during an incident?▼

Avoid attribution during active incidents; containment and eradication take priority, and premature attribution can misdirect response. Profile refinement and attribution analysis should occur post-incident with multiple corroborating data points.

Why is IOC-based threat actor profiling unreliable?▼

IP addresses and domains rotate within weeks, making IOC-centric profiles stale quickly. TTPs are far more durable behavioral fingerprints, so profiles should be built around ATT&CK techniques rather than infrastructure indicators.

How often should threat actor profiles be updated?▼

Profiles should be revalidated quarterly because adversary TTPs drift, new malware appears, and targeting shifts. Date every profile and never present a stale profile as current intelligence.

Related Skills

Explore More Software Engineering Skills→
daemon-blockint-techdaemon-blockint-tech
7

cti-analyst

Vet and package cyber threat intelligence with STIX/TAXII exports and ATT&CK mappings.

Community
Advanced
briiirussellbriiirussell
345

siem-detection

Assess log source coverage, author Sigma rules, and translate to SIEM query languages.

Community
Advanced
x-cmdx-cmd
4.6k

x-kev

List and filter CISA Known Exploited Vulnerabilities by priority and status.

Official
Basic
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-intelligence-feeds

Normalize threat intelligence feeds into STIX 2.1 indicators.

Community
Advanced