Individual skill
correlating-threat-campaigns
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
internal/tools/skills/data/threat-intelligence/correlating-threat-campaigns/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,320
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- campaign-analysis Declared skill tag
- correlation Declared skill tag
- misp Declared skill tag
- att&ck Declared skill tag
- threat-actor Declared skill tag
- intrusion-set Declared skill tag
- clustering Declared skill tag
- cti Declared skill tag
- security Derived category
- marketing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Correlating Threat Campaigns
## When to Use
Use this skill when:
- Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs)
- An ISAC partner shares indicators from an incident that match your own historical events
- Building a campaign report linking adversary activity over weeks or months to a single operation
**Do not use** this skill to force correlation based on weak signals — false campaign attribution misleads defenders and wastes resources on incorrect threat models.
## Detection Gaps & Validation
- **Shared-infrastructure false attribution:** a common Cloudflare/AWS CloudFront IP or a recycled bulletproof host links unrelated actors. Require a second independent pivot (TLS cert serial, JARM hash, malware config) before merging events into one campaign.
- **Capability conflation:** Cobalt Strike, Sliver, and Metasploit are shared across many actors. A default beacon watermark or stock profile is weak evidence - confirm with a unique malleable C2 profile field or staging key.