skills.rest
Liberty91LTD
Liberty91LTDOFFICIAL
Explore all skills by this author →
Website𝕏@liberty__91GitHub

threat-actor-profiling

Organize threat actor intelligence into update-ready profiles with MITRE ATT&CK mappings.

15|5|Updated Apr 6, 2026
Search Tags:#attribution#profile#threat-intelligence#ttp#threat-actor#campaign-history#intel-gaps
One-click install
npx skills add https://github.com/Liberty91LTD/cti-skills --skill threat-actor-profiling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-actor-profiling
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/threat-actor-profiling
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill threat-actor-profiling

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat actor profiling is essential for consolidating scattered intelligence about groups into a single, actionable profile that supports attribution, campaign tracking, and strategic decision-making.

Core Features & Use Cases

  • Living template for threat actor data including attribution, TTPs, campaigns, and gaps.
  • Structured sections for overview, attribution assessment, targeting, TTPs, tooling, infrastructure, and intelligence gaps.
  • Maintenance workflow to keep profiles up-to-date as new intelligence emerges and campaigns evolve.

Quick Start

Create a new threat actor profile template for a chosen group and populate it with available intelligence.

Frequently Asked Questions about threat-actor-profiling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is a threat actor profile and what should it include?▼

A threat actor profile consolidates scattered intelligence about a group into a single document. It includes structured sections for attribution assessment, targeting, TTPs, tooling, infrastructure, and intelligence gaps.

How do I build a threat actor profile for campaign tracking and attribution?▼

To build a threat actor profile, populate a living template with available intelligence on the group. Apply this to analyst workflows for attribution discussions, campaign tracking, and tooling alignment across MITRE ATT&CK mappings.

Does threat actor profiling support mapping intelligence to MITRE ATT&CK TTPs?▼

Yes, threat actor profiling supports mapping intelligence to MITRE ATT&CK TTPs. The profile provides a structured TTP cataloging section to align threat intelligence with the ATT&CK framework.

How do I track intelligence gaps when consolidating threat intelligence?▼

You track intelligence gaps by using a dedicated section within the threat actor profile. This structured approach highlights missing data during attribution assessment and campaign tracking to guide future collection.

How do I maintain a threat actor profile as new campaign intelligence emerges?▼

You maintain a threat actor profile using a built-in maintenance workflow. This keeps the living document up-to-date as new intelligence emerges and campaigns evolve, ensuring the profile remains actionable.

Can I use a threat actor profile template for strategic threat intelligence decision-making?▼

Yes, you can use a threat actor profile template for strategic decision-making. It consolidates scattered intelligence into an actionable format that supports attribution, campaign tracking, and strategic planning.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

extracting-iocs-from-malware-samples

Extract IOCs from malware samples and export STIX 2.1 and CSV artifacts.

Community
Advanced
dapperdiversdapperdivers
1

threat-intel-aggregator

Aggregate threat intelligence feeds and vulnerability data into daily security briefings.

Community
Advanced
Jayarr03Jayarr03

mitre-attack-review

Map system attack paths to MITRE ATT&CK techniques and objectives.

Community
Advanced
ArianHobson333ArianHobson333
7

threat-profile

Builds threat actor profiles for adversary emulation and outputs JSON for conops.

Community
Intermediate