Correlating Threat Campaigns

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify

Category: development Source: mukul975/Anthropic-Cybersecurity-Skills

What Is Correlating Threat Campaigns?

The Correlating Threat Campaigns skill is designed for cybersecurity professionals tasked with connecting the dots between seemingly unrelated security incidents. This skill leverages advanced correlation techniques to unify disparate security events, indicators of compromise (IOCs), and adversary behaviors observed across different timeframes and organizations. By mapping these elements, defenders can identify unified threat campaigns, attribute them to specific threat actors, and extract common indicators to enhance detection and response capabilities.

At its core, this skill enables threat intelligence and security operations teams to move beyond siloed incident analysis, uncovering broad adversary operations that span multiple targets and periods. It is especially relevant in environments using Threat Intelligence Platforms (TIPs), Security Information and Event Management (SIEM) systems, and collaborative threat-sharing frameworks like MISP (Malware Information Sharing Platform).

Why Use the Correlating Threat Campaigns Skill?

Modern adversaries seldom limit their operations to a single organization or incident. Attackers often reuse infrastructure, malware, and tactics across multiple campaigns, making it vital for defenders to correlate incidents and IOCs across boundaries. Without this capability, security teams risk treating related incidents as isolated events, missing the opportunity to identify and disrupt larger campaigns.

Key benefits of using this skill include:

• Comprehensive Threat Visibility: By correlating data from multiple sources, organizations can recognize patterns that single events alone do not reveal.
• Improved Attribution: Linking incidents to known threat actors or intrusion sets enhances the quality of threat intelligence and supports more effective response strategies.
• Campaign-Level Intelligence: Generating insights at the campaign level supports proactive defense, sector-wide alerts, and intelligence sharing with partners.
• Enhanced Detection: Identifying shared IOCs and behaviors enables security teams to develop more robust detection rules and signatures.

How to Use Correlating Threat Campaigns

This skill activates when users need to analyze, cluster, or correlate incidents at the campaign level. Practical usage typically involves the following steps:

1. Data Gathering: Aggregate security incidents, IOCs (such as IP addresses, file hashes, domains), and related event metadata from your SIEM, TIP, or MISP instance.
2. Indicator Correlation: Cross-reference IOCs across incidents and organizations. Look for overlaps such as repeated use of specific infrastructure or malware.
3. Behavioral Analysis: Map adversary tactics, techniques, and procedures (TTPs) using frameworks like MITRE ATT&CK to identify behavioral patterns.
4. Clustering and Attribution: Group incidents with shared indicators or behaviors to form clusters that may represent a unified campaign. Where possible, attribute these clusters to known threat actors or intrusion sets.
5. Actionable Intelligence Extraction: Document correlated campaigns, highlighting common indicators and behaviors for further detection and sharing.

Example: IOC Correlation in Python

Below is a simplified code example for correlating IOCs across multiple incidents using Python:

## Example: Correlating IOCs across incidents

incidents = [
    {"id": 1, "iocs": {"ip": "192.0.2.10", "hash": "abc123"}},
    {"id": 2, "iocs": {"ip": "198.51.100.5", "hash": "abc123"}},
    {"id": 3, "iocs": {"ip": "203.0.113.15", "hash": "def456"}},
]

## Find incidents sharing the same hash
from collections import defaultdict

hash_map = defaultdict(list)
for incident in incidents:
    hash_map[incident["iocs"]["hash"]].append(incident["id"])

for hash_value, related_ids in hash_map.items():
    if len(related_ids) > 1:
        print(f"Incidents {related_ids} share hash {hash_value}")

This approach can be extended to correlate on additional fields, such as C2 IPs, domains, or TTPs.

MISP Correlation

For organizations leveraging MISP, the skill also activates for MISP correlation queries:

## Example: Using MISP API to find related events
curl -H "Authorization: <API_KEY>" \
     -H "Accept: application/json" \
     https://<misp-instance>/events/restSearch \
     -d '{"value": "abc123"}'

This retrieves all events sharing a specific IOC, supporting campaign-level analysis.

When to Use It

Activate the Correlating Threat Campaigns skill in scenarios such as:

• Multiple incidents in your environment exhibit overlapping IOCs or similar TTPs.
• ISAC or industry partners share indicators that match your historical events.
• Compiling a campaign report that links adversary activity over weeks or months into a cohesive operation.
• Conducting cross-organizational or sector-wide analysis to identify coordinated attack campaigns.
• Building detection rules or intelligence products focused on adversary campaigns rather than isolated incidents.

It is not appropriate to use this skill when incidents have only weak or speculative links. Forced correlation can result in false attributions, misguiding defenders and undermining threat intelligence quality.

Important Notes

• Data Quality Matters: Reliable correlation depends on the accuracy and completeness of incident data and IOCs.
• Avoid Over-Correlation: Do not force connections based on superficial similarities or weak signals. Always validate links with supporting evidence.
• Update Intelligence Regularly: Threat campaigns and actor behaviors evolve, so refresh your correlation logic and data sources frequently.
• Leverage Standards: Use recognized frameworks such as MITRE ATT&CK for behavioral mapping, and MISP or STIX/TAXII for structured threat intelligence sharing.
• Compliance and Privacy: Ensure that cross-organizational analysis complies with legal and privacy requirements, especially when sharing sensitive indicators.

By systematically correlating threat campaigns, security teams can uncover broader adversary operations, strengthen detection, and provide more actionable intelligence to defend their organizations and the wider community.