<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-threat-actor-attribution
description: >-
  Attribute threat actors using TTPs, infrastructure, and intelligence correlation with structured analytic techniques.
domain: cybersecurity
subdomain: incident-response
tags:
  - attribution
  - threat-intelligence
  - ttp-analysis
  - diamond-model
  - infrastructure-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1583", "T1588", "T1592"]
---

# Performing Threat Actor Attribution

## Overview

Threat actor attribution correlates TTPs, infrastructure, tooling, and victimology to identify the group behind an intrusion. Attribution supports risk assessment, legal proceedings, and intelligence sharing — but must carry explicit confidence levels. Misattribution causes worse outcomes than no attribution.

Mode: `[MODE: INCIDENT]` — Evidence-based. Confidence-tagged. Document your reasoning.

## Attribution Evidence Types

| Evidence Class | Examples | Confidence Contribution |
|---|---|---|
| TTPs | ATT&CK techniques, tooling chains, operational patterns | High — behaviors are costly to change |
| Infrastructure | C2 IPs, domains, ASN, hosting provider, certificate subjects | Medium — can be rented or shared |
| Malware | Sample hashes, code reuse, PDB paths, compile artifacts | High — development artifacts are sticky |
| Victimology | Target sector, geography, org size | Medium — narrows candidate set |
| Language/timezone | Keyboard layout artifacts, compile timestamps, forum posts | Low — easily faked |
| HUMINT/SIGINT | Government reporting, partnership intelligence | High (when sourced) — not always shareable |

## Diamond Model Dimensions

| Axis | Questions |
|---|---|
| Adversary | Who is this group? Aliases, previous campaigns, state/criminal nexus? |
| Capability | What tools and techniques did they use? Custom vs commodity? |
| Infrastructure | What IPs, domains, and hosting did they use? Provider patterns? |
| Victim | Who was targeted? Why this org, sector, or timing? |

## Analytic Confidence Scale

| Level | Label | Meaning |
|---|---|---|
| 5 | Confirmed | Multiple independent evidence types; corroborated by government attribution |
| 4 | High | Strong TTP match + infrastructure overlap + malware reuse |
| 3 | Moderate | TTP match + one additional evidence class |
| 2 | Low | Single evidence class; alternative explanations exist |
| 1 | Speculative | Pattern similarity only; insufficient corroboration |

## Workflow

1. Document all evidence with source and timestamp before beginning analysis
2. Map observed TTPs to ATT&CK and search threat intel for matching groups
3. Pivot on infrastructure (IP → domain → ASN → hosting → certificate) via Shodan/Censys/PassiveDNS
4. Submit malware samples to VirusTotal; search for code reuse via Yara/VxUnderground
5. Check CTI feeds (MISP, OpenCTI, ISACs) for matching IOCs
6. Apply Diamond Model across all four axes
7. Assign confidence level with explicit rationale
8. Document alternative hypotheses and why they were ruled out
9. Share via structured format (STIX 2.1, MISP event)

## Infrastructure Pivoting

| Pivot Type | Tool | What You Find |
|---|---|---|
| IP → domains | Shodan, Censys, PassiveDNS | Domains hosted on C2 IP |
| Domain → cert | crt.sh, Censys | Certificate subjects, SANs, org name |
| Cert → infrastructure | Shodan cert search | Other servers sharing certificate |
| Hash → samples | VirusTotal, MalwareBazaar | Sibling samples, campaign clusters |
| Sample → config | CAPE, Any.run | C2 endpoints, mutex, config keys |

## Structured Output

```
ATTRIBUTION ASSESSMENT
Campaign: {name}
Suspected Actor: {alias} | Confidence: {level}/5
Evidence Summary:
  TTPs matched: {list}
  Infrastructure overlap: {list}
  Malware reuse: {hashes/families}
Alternative Hypotheses: {list with why ruled out}
Recommendations: {action items for defenders}
TLP: {WHITE/GREEN/AMBER/RED}
```

## Related Techniques

- [Performing Email Compromise Investigation](../performing-email-compromise-investigation/SKILL.md)
- [Performing Threat Intelligence Analysis](../../../threat-intelligence/techniques/analyzing-threat-actor-ttps/SKILL.md)
