agentsclimarketplace

Profiling a threat actor from ttps

Skill meltedinhex/analyst-ai-pack/skills/profiling-a-threat-actor-from-ttps

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill profiling-a-threat-actor-from-ttps

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profile and comparing it against known-group technique sets to estimate similarity and candidate attribution. Activates for requests to profile a threat actor, compare observed TTPs to known groups, or estimate attribution from technique overlap.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, as published. Nobody here has run it

Profiling a Threat Actor From TTPs

When to Use

  • You have a set of observed ATT&CK techniques from an intrusion and want to build a TTP profile and compare it against known-group technique sets for candidate attribution.
  • You are estimating similarity, not asserting attribution.

Do not use technique overlap as confirmed attribution — many groups share common techniques. Present candidates with similarity scores and the need for corroborating intel.

Prerequisites

  • Observed technique IDs from the intrusion and a reference of group→techniques (CSV/JSON).

Workflow

Step 1: Build the observed TTP profile

Collect the deduplicated set of observed ATT&CK technique IDs (including sub-techniques).

Step 2: Compare against known groups

python scripts/analyst.py compare --observed observed.txt --groups groups.json

Computes Jaccard and overlap-coefficient similarity between the observed set and each group's technique set, ranking candidate groups.

Step 3: Weigh distinctive techniques

Prioritize matches on less-common techniques (shared rare TTPs are stronger signals than ubiquitous ones).

Step 4: Document

Report ranked candidates with similarity scores, the overlapping techniques, and an explicit low/medium confidence — never definitive attribution from TTPs alone.

Validation

  • Similarity is computed on technique-ID sets (sub-techniques included).
  • Candidates are ranked by both Jaccard and overlap coefficient.
  • Output states confidence and lists the overlapping techniques.

Pitfalls

  • Over-attributing on common techniques (T1059, T1027) shared by most groups.
  • Reference group data being incomplete or out of date.
  • Treating a single high overlap as proof without corroborating intel.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.