Campaign Attribution Evidence Analysis

High-Confidence Threat Actor Attribution

Moving from a "hunch" to a defensible attribution assessment is one of the hardest tasks for CTI analysts. This skill provides a rigorous, analytical framework to evaluate cyber campaign evidence, helping you move beyond simple indicator matching to structured intelligence analysis.

What it does

This skill processes CTI reports, incident artifacts, and TTPs to generate a comprehensive attribution profile. It uses industry-standard methodologies to ensure your findings are objective and resilient to scrutiny. It supports:

• Diamond Model Mapping: Structuring adversary, capability, infrastructure, and victim relationships.
• Analysis of Competing Hypotheses (ACH): Testing evidence against multiple actor profiles to eliminate bias.
• Confidence Scoring: Assigning standardized ratings (High/Med/Low) based on source provenance and evidence strength.
• Evidence Register: Building a traceable log of indicators, malware overlaps, and timing patterns.

Why use this skill?

Prompting an AI for attribution often results in "hallucinated" certainty or generic summaries. This skill enforces analytical rigor by requiring alternative hypotheses and identifying intelligence gaps. It filters out weak signals like publicly available tools or easily faked language artifacts, ensuring your report holds up in a briefing or board meeting.

Output

The output is a structured analyst report including an ACH matrix, a Diamond Model summary, a formal confidence statement, and defensive recommendations for SOC and IR teams.