threat-actor-profiling

Threat Actor Profiling Skill

Generate structured, actionable threat actor profiles following a deliverable-first methodology grounded in the 5W1H framework and the Diamond Model of Intrusion Analysis.

When to Use

• User asks to profile or research a threat actor / APT group
• User needs to produce an intelligence deliverable about an adversary
• User wants to structure existing threat data into a TA profile
• User is responding to an RFI or incident involving a known threat actor
• User wants to assess capability, intent, or victimology of a group

Core Workflow

Follow these six steps in order. Each step builds toward a complete profile.

Step 1: Define Scope and Purpose

Before collecting any data, clarify:

1. Profile type: Is this for continuous internal tracking or an incident-driven analytical deliverable?
2. Audience: Who will consume this? (CTI team, SOC, IR, executives, legal, comms)
3. Trigger: Is this RFI-driven, incident-driven, or proactive tracking?

Use this decision matrix:

Purpose	Audience	Focus	Risk to Avoid
Internal tracking	CTI, SOC, IR	Structured IOCs and TTPs, minimal narrative	Building a library nobody uses
Analytical deliverable	Management, Legal, Comms, IR	Timelines, impact analysis, recommendations	Unfocused data collection

Step 2: Collect Data Sources

Gather from two categories:

Internal telemetry (if incident-related):

• SIEM logs
• EDR/XDR alerts
• IAM / Active Directory events
• NDR and NetFlow data
• Cloud control plane and SaaS logs
• Honeypot data
• Vulnerability management systems

External intelligence:

• TIPs (OpenCTI, ThreatConnect, CrowdStrike Falcon, etc.)
• Content aggregators (Recorded Future, Feedly, Inoreader)
• OSINT tools (VirusTotal, urlscan.io, any.run, Shodan, Censys, abuse.ch)
• Sharing communities (ISACs, FIRST, bilateral partners)

Evaluate source quality using the Admiralty Code:

• Source Reliability: A (completely reliable) through F (cannot be judged)
• Information Credibility: 1 (confirmed) through 6 (cannot be judged)