From cybersecurity-skills
Correlates disparate security incidents and IOCs across organizations to identify unified threat campaigns and attribute to common threat actors. Use for campaign analysis and incident clustering.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills:correlating-threat-campaignsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill when:
Use this skill when:
Do not use this skill to force correlation based on weak signals — false campaign attribution misleads defenders and wastes resources on incorrect threat models.
Gather all candidate events for correlation from:
Normalize all events to STIX 2.1 schema with consistent timestamp (UTC), indicator types, and confidence scores. Ensure all indicators have source attribution and collection date.
Apply systematic pivot analysis across four dimensions:
Infrastructure pivots:
Capability pivots:
Temporal pivots:
Victimology pivots:
Apply weighted scoring for campaign attribution:
def calculate_campaign_confidence(events: list) -> float:
scores = []
# Infrastructure overlap (highest weight — most discriminating)
infra_overlap = count_shared_infra(events) / len(events)
scores.append(infra_overlap * 40)
# Capability overlap (high weight — TTPs are durable)
capability_overlap = count_shared_ttps(events) / len(events)
scores.append(capability_overlap * 35)
# Temporal proximity (moderate weight)
temporal_score = assess_temporal_clustering(events)
scores.append(temporal_score * 15)
# Victimology alignment (lower weight — many actors target same sector)
victim_score = assess_victim_pattern(events)
scores.append(victim_score * 10)
total = sum(scores)
if total >= 70: return "HIGH"
elif total >= 45: return "MEDIUM"
else: return "LOW"
In OpenCTI or Maltego, construct campaign graph:
Label each relationship with evidence reference and confidence.
Structure the campaign report:
| Term | Definition |
|---|---|
| Campaign | STIX object representing a grouping of adversarial behaviors with common objectives over a defined time period |
| Intrusion Set | STIX object grouping related intrusion activity by common objectives, even when actor identity is uncertain |
| Pivot | Using a single data point (IOC, infrastructure, TTP) to discover related events or adversary artifacts |
| Clustering | Machine learning or manual grouping of incidents based on feature similarity to identify campaign boundaries |
| False Correlation | Incorrect linking of unrelated incidents due to shared infrastructure (CDNs, shared hosting) or common tools |
npx claudepluginhub costrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skillsCorrelates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns and attribute them to common threat actors.
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns and attribute them to common threat actors.
Correlates security incidents, IOCs, and adversary behaviors across organizations and time to identify threat campaigns, attribute actors, and extract shared indicators. For incident clustering, cross-org IOC analysis, and campaign reports.