Analyzing Campaign Attribution Evidence

mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-campaign-attribution-evidence

作者 mukul97554a798831d2266a3ca61ce68a7acb80b81160d57Apache-2.0收錄於 2026年10月9日更新於 2026年10月9日

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

包含腳本Security Research & Analysis

AI 產生的概覽

運用鑽石模型與競爭假設分析評估網路行動證據，將攻擊歸因於特定威脅行為者。

功能: 此技能引導對網路行動進行結構化歸因分析，從六類證據著手：基礎設施重疊、TTP 一致性、惡意程式碼相似度、作戰模式、語言痕跡與受害者特徵。它會將證據對多個競爭性威脅行為者假設評為一致、不一致或中立，比較基礎設施與 ATT&CK 技術集合，並將假設排序為高、中、低信心度。最終產出結構化歸因評估報告，包含排序、主要歸因結論與證據摘要。
適用情境: 當事件調查需要為某次網路行動提出可辯護的歸因信心度時使用。適合 SOC 分析師與威脅情報團隊權衡相互競爭的行為者假設，並記錄假旗考量。
執行需求: Python 3.9+ 以及 attackcti、stix2、networkx 函式庫；可存取 MISP 或 OpenCTI 等威脅情報平台；熟悉鑽石模型、MITRE ATT&CK 組織側寫，以及惡意程式與基礎設施追蹤。此技能附有可執行指令碼。

Analyzing Campaign Attribution Evidence

Overview

Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.

When to Use

When investigating security incidents that require analyzing campaign attribution evidence
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with attackcti, stix2, networkx libraries
Access to threat intelligence platforms (MISP, OpenCTI)
Understanding of Diamond Model of Intrusion Analysis
Familiarity with MITRE ATT&CK threat group profiles
Knowledge of malware analysis and infrastructure tracking techniques

Key Concepts

Attribution Evidence Categories

Infrastructure Overlap: Shared C2 servers, domains, IP ranges, hosting providers
TTP Consistency: Matching ATT&CK techniques and sub-techniques across campaigns
Malware Code Similarity: Shared code bases, compilers, PDB paths, encryption routines
Operational Patterns: Timing (working hours, time zones), targeting patterns, operational tempo
Language Artifacts: Embedded strings, variable names, error messages in specific languages
Victimology: Target sector, geography, and organizational profile consistency

Confidence Levels

High Confidence: Multiple independent evidence categories converge on same actor
Moderate Confidence: Several evidence categories match, some ambiguity remains
Low Confidence: Limited evidence, possible false flags or shared tooling

Analysis of Competing Hypotheses (ACH)

Structured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.

Workflow

Step 1: Collect Attribution Evidence

python

from stix2 import MemoryStore, Filterfrom collections import defaultdict
class AttributionAnalyzer:    def __init__(self):        self.evidence = []        self.hypotheses = {}
    def add_evidence(self, category, description, value, confidence):        self.evidence.append({            "category": category,            "description": description,            "value": value,            "confidence": confidence,            "timestamp": None,        })
    def add_hypothesis(self, actor_name, actor_id=""):        self.hypotheses[actor_name] = {            "actor_id": actor_id,            "consistent_evidence": [],            "inconsistent_evidence": [],            "neutral_evidence": [],            "score": 0,        }
    def evaluate_evidence(self, evidence_idx, actor_name, assessment):        """Assess evidence against a hypothesis: consistent/inconsistent/neutral."""        if assessment == "consistent":            self.hypotheses[actor_name]["consistent_evidence"].append(evidence_idx)            self.hypotheses[actor_name]["score"] += self.evidence[evidence_idx]["confidence"]        elif assessment == "inconsistent":            self.hypotheses[actor_name]["inconsistent_evidence"].append(evidence_idx)            self.hypotheses[actor_name]["score"] -= self.evidence[evidence_idx]["confidence"] * 2        else:            self.hypotheses[actor_name]["neutral_evidence"].append(evidence_idx)
    def rank_hypotheses(self):        """Rank hypotheses by attribution score."""        ranked = sorted(            self.hypotheses.items(),            key=lambda x: x[1]["score"],            reverse=True,        )        return [            {                "actor": name,                "score": data["score"],                "consistent": len(data["consistent_evidence"]),                "inconsistent": len(data["inconsistent_evidence"]),                "confidence": self._score_to_confidence(data["score"]),            }            for name, data in ranked        ]
    def _score_to_confidence(self, score):        if score >= 80:            return "HIGH"        elif score >= 40:            return "MODERATE"        else:            return "LOW"

from stix2 import MemoryStore, Filterfrom collections import defaultdict
class AttributionAnalyzer:    def __init__(self):        self.evidence = []        self.hypotheses = {}
    def add_evidence(self, category, description, value, confidence):        self.evidence.append({            "category": category,            "description": description,            "value": value,            "confidence": confidence,            "timestamp": None,        })
    def add_hypothesis(self, actor_name, actor_id=""):        self.hypotheses[actor_name] = {            "actor_id": actor_id,            "consistent_evidence": [],            "inconsistent_evidence": [],            "neutral_evidence": [],            "score": 0,        }
    def evaluate_evidence(self, evidence_idx, actor_name, assessment):        """Assess evidence against a hypothesis: consistent/inconsistent/neutral."""        if assessment == "consistent":            self.hypotheses[actor_name]["consistent_evidence"].append(evidence_idx)            self.hypotheses[actor_name]["score"] += self.evidence[evidence_idx]["confidence"]        elif assessment == "inconsistent":            self.hypotheses[actor_name]["inconsistent_evidence"].append(evidence_idx)            self.hypotheses[actor_name]["score"] -= self.evidence[evidence_idx]["confidence"] * 2        else:            self.hypotheses[actor_name]["neutral_evidence"].append(evidence_idx)
    def rank_hypotheses(self):        """Rank hypotheses by attribution score."""        ranked = sorted(            self.hypotheses.items(),            key=lambda x: x[1]["score"],            reverse=True,        )        return [            {                "actor": name,                "score": data["score"],                "consistent": len(data["consistent_evidence"]),                "inconsistent": len(data["inconsistent_evidence"]),                "confidence": self._score_to_confidence(data["score"]),            }            for name, data in ranked        ]
    def _score_to_confidence(self, score):        if score >= 80:            return "HIGH"        elif score >= 40:            return "MODERATE"        else:            return "LOW"

Step 2: Infrastructure Overlap Analysis

python

def analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):    """Compare infrastructure between two campaigns for attribution."""    overlap = {        "shared_ips": set(campaign_a_infra.get("ips", [])).intersection(            campaign_b_infra.get("ips", [])        ),        "shared_domains": set(campaign_a_infra.get("domains", [])).intersection(            campaign_b_infra.get("domains", [])        ),        "shared_asns": set(campaign_a_infra.get("asns", [])).intersection(            campaign_b_infra.get("asns", [])        ),        "shared_registrars": set(campaign_a_infra.get("registrars", [])).intersection(            campaign_b_infra.get("registrars", [])        ),    }
    overlap_score = 0    if overlap["shared_ips"]:        overlap_score += 30    if overlap["shared_domains"]:        overlap_score += 25    if overlap["shared_asns"]:        overlap_score += 15    if overlap["shared_registrars"]:        overlap_score += 10
    return {        "overlap": {k: list(v) for k, v in overlap.items()},        "overlap_score": overlap_score,        "assessment": "STRONG" if overlap_score >= 40 else "MODERATE" if overlap_score >= 20 else "WEAK",    }

def analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):    """Compare infrastructure between two campaigns for attribution."""    overlap = {        "shared_ips": set(campaign_a_infra.get("ips", [])).intersection(            campaign_b_infra.get("ips", [])        ),        "shared_domains": set(campaign_a_infra.get("domains", [])).intersection(            campaign_b_infra.get("domains", [])        ),        "shared_asns": set(campaign_a_infra.get("asns", [])).intersection(            campaign_b_infra.get("asns", [])        ),        "shared_registrars": set(campaign_a_infra.get("registrars", [])).intersection(            campaign_b_infra.get("registrars", [])        ),    }
    overlap_score = 0    if overlap["shared_ips"]:        overlap_score += 30    if overlap["shared_domains"]:        overlap_score += 25    if overlap["shared_asns"]:        overlap_score += 15    if overlap["shared_registrars"]:        overlap_score += 10
    return {        "overlap": {k: list(v) for k, v in overlap.items()},        "overlap_score": overlap_score,        "assessment": "STRONG" if overlap_score >= 40 else "MODERATE" if overlap_score >= 20 else "WEAK",    }

Step 3: TTP Comparison Across Campaigns

python

from attackcti import attack_client
def compare_campaign_ttps(campaign_techniques, known_actor_techniques):    """Compare campaign TTPs against known threat actor profiles."""    campaign_set = set(campaign_techniques)    actor_set = set(known_actor_techniques)
    common = campaign_set.intersection(actor_set)    unique_campaign = campaign_set - actor_set    unique_actor = actor_set - campaign_set
    jaccard = len(common) / len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0
    return {        "common_techniques": sorted(common),        "common_count": len(common),        "unique_to_campaign": sorted(unique_campaign),        "unique_to_actor": sorted(unique_actor),        "jaccard_similarity": round(jaccard, 3),        "overlap_percentage": round(len(common) / len(campaign_set) * 100, 1) if campaign_set else 0,    }

from attackcti import attack_client
def compare_campaign_ttps(campaign_techniques, known_actor_techniques):    """Compare campaign TTPs against known threat actor profiles."""    campaign_set = set(campaign_techniques)    actor_set = set(known_actor_techniques)
    common = campaign_set.intersection(actor_set)    unique_campaign = campaign_set - actor_set    unique_actor = actor_set - campaign_set
    jaccard = len(common) / len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0
    return {        "common_techniques": sorted(common),        "common_count": len(common),        "unique_to_campaign": sorted(unique_campaign),        "unique_to_actor": sorted(unique_actor),        "jaccard_similarity": round(jaccard, 3),        "overlap_percentage": round(len(common) / len(campaign_set) * 100, 1) if campaign_set else 0,    }

Step 4: Generate Attribution Report

python

def generate_attribution_report(analyzer):    """Generate structured attribution assessment report."""    rankings = analyzer.rank_hypotheses()
    report = {        "assessment_date": "2026-02-23",        "total_evidence_items": len(analyzer.evidence),        "hypotheses_evaluated": len(analyzer.hypotheses),        "rankings": rankings,        "primary_attribution": rankings[0] if rankings else None,        "evidence_summary": [            {                "index": i,                "category": e["category"],                "description": e["description"],                "confidence": e["confidence"],            }            for i, e in enumerate(analyzer.evidence)        ],    }
    return report

def generate_attribution_report(analyzer):    """Generate structured attribution assessment report."""    rankings = analyzer.rank_hypotheses()
    report = {        "assessment_date": "2026-02-23",        "total_evidence_items": len(analyzer.evidence),        "hypotheses_evaluated": len(analyzer.hypotheses),        "rankings": rankings,        "primary_attribution": rankings[0] if rankings else None,        "evidence_summary": [            {                "index": i,                "category": e["category"],                "description": e["description"],                "confidence": e["confidence"],            }            for i, e in enumerate(analyzer.evidence)        ],    }
    return report

Validation Criteria

Evidence collection covers all six attribution categories
ACH matrix properly evaluates evidence against competing hypotheses
Infrastructure overlap analysis identifies shared indicators
TTP comparison uses ATT&CK technique IDs for precision
Attribution confidence levels are properly justified
Report includes alternative hypotheses and false flag considerations

References

來源與署名

來源：mukul975/Anthropic-Cybersecurity-Skills位於skills/analyzing-campaign-attribution-evidence提交54a7988

授權條款： Apache-2.0

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Analyzing Campaign Attribution Evidence

Analyzing Campaign Attribution Evidence

Overview

When to Use

Prerequisites

Key Concepts

Attribution Evidence Categories

Confidence Levels

Analysis of Competing Hypotheses (ACH)

Workflow

Step 1: Collect Attribution Evidence

Step 2: Infrastructure Overlap Analysis

Step 3: TTP Comparison Across Campaigns

Step 4: Generate Attribution Report

Validation Criteria

References

來源與署名

更多來自 mukul975/Anthropic-Cybersecurity-Skills 的技能

Exploiting Sql Injection Vulnerabilities

Analyzing Network Traffic With Wireshark

Analyzing Dns Logs For Exfiltration

Analyzing Cloud Storage Access Patterns

Analyzing Certificate Transparency For Phishing

Analyzing Browser Forensics With Hindsight

更多Security技能

Kyc Rules

Kyc Rules

Compliance Tracking

Google Cloud Scc Remediation

Google Cloud Recipe Auth

Dpop Adoption