Guide · Agent skill
How to use the Campaign Attribution Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the analyzing-campaign-attribution-evidence agent skill does, how to install it for Claude, and how to ask it for an attribution assessment. It is written for analysts and responders who have not used agent skills before. By the end you will know how to install the skill, phrase a request so it triggers, and what limits to keep in mind when reading its output.
Campaign Attribution Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip the analyzing-campaign-attribution-evidence folder.
- 2Place the folder. Move it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. For the Claude apps, upload it under Settings → Capabilities → Skills.
- 3Install Python requirements. Make sure Python 3.9+ is available with attackcti, stix2, networkx and requests installed.
- 4Gather your evidence. List the infrastructure, ATT&CK techniques, malware details, timing and language clues you have for the incident.
- 5Ask for an assessment. Describe the investigation and ask for an attribution with a confidence level, naming any candidate actors.
- 6Review the scoring. Check which evidence categories drive the ranking and whether the inputs are complete or biased.
- 7Write up the findings. Ask the agent to fill in assets/template.md, then have an analyst validate the conclusions before sharing.
What the skill makes the agent do
An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This skill tells the agent to work out which threat group may be behind a cyber operation, using a structured method rather than an open-ended guess.
It combines the Diamond Model of Intrusion Analysis with Analysis of Competing Hypotheses (ACH). Evidence is grouped into categories: infrastructure overlap, TTP consistency (matching MITRE ATT&CK techniques), malware code similarity, operational timing, language artifacts and victimology. Each piece of evidence is judged consistent, inconsistent or neutral against each candidate actor, and the result is a confidence-rated assessment.
- Infrastructure overlap: shared C2 servers, domains, IP ranges, hosting providers
- TTP consistency: matching ATT&CK techniques and sub-techniques across campaigns
- Malware code similarity: shared code bases, compilers, PDB paths, encryption routines
- Operational patterns: working hours, time zones, targeting, tempo
- Language artifacts: embedded strings, variable names, error messages
- Victimology: target sector, geography and organisational profile
Install the skill from the ZIP or the Claude apps
Download the skill ZIP from this page and unzip it. The unzipped folder should contain SKILL.md, the scripts/ folder, the references/ folder and the assets/ folder. Then pick one of the install locations below.
For a personal install across your projects, unzip the skill into ~/.claude/skills/. To scope it to a single project, unzip it into that project's .claude/skills/ folder.
If you use the Claude apps instead of Claude Code, upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
Install the Python requirements
The bundled scripts need Python 3.9 or newer, plus the libraries attackcti, stix2, networkx and requests. Install these into the Python environment the agent will use. The skill also lists access to MISP or OpenCTI as optional; you only need it if you want to pull intelligence from those platforms.
- Python 3.9+
- attackcti, stix2, networkx, requests
- Optional: access to MISP or OpenCTI
Trigger the skill with a natural request
You do not need a special command. Describe the investigation and ask for an attribution assessment with a confidence level. The skill's description says it applies when an incident investigation needs a defensible attribution confidence level, so requests phrased that way are the most likely to load it.
Include the evidence you have. The more specific your inputs (IP addresses, domains, ATT&CK technique IDs, malware details, timestamps), the more useful the scoring will be. If you name candidate actors, the agent can rank them as competing hypotheses.
- 'Assess which threat actor may be behind this campaign and give me a confidence level.'
- 'Compare the infrastructure from these two intrusions and tell me how strong the overlap is.'
- 'Score these candidate groups against the evidence using ACH and show what is inconsistent with each.'
Read the output with the limits in mind
The confidence labels come from fixed heuristic thresholds. In the skill's ACH code, a score of 80 or more is labelled HIGH, 40 to 79 MODERATE, and below 40 LOW. The infrastructure overlap score uses fixed weights (IPs 30, domains 25, ASNs 15, registrars 10), and is labelled STRONG at 40 or more and MODERATE at 20 or more.
These are triage aids, not proof. The skill does not validate evidence, and incomplete or biased inputs can produce misleading rankings. Treat the output as a structured starting point for analyst review.
- Keep a human analyst in the review loop.
- Check which evidence categories actually support the ranking.
- Do not use the result as proof of responsibility for legal or public attribution.
if score >= 80: return "HIGH"
elif score >= 40: return "MODERATE"
else: return "LOW"Use the report template for write-ups
The skill includes assets/template.md, a report template with metadata fields (report ID, date, classification, analyst, confidence), an executive summary, key findings with confidence and ATT&CK IDs, an indicators table, recommendations and references. Ask the agent to fill it in once you have reviewed the assessment.
The references folder covers the Diamond Model pivots, the ACH matrix format, and related standards such as STIX 2.1, TAXII 2.1, MITRE ATT&CK and the Traffic Light Protocol. Those files are useful if you need to explain the method to a reader.
- assets/template.md: report structure
- references/workflows.md and references/api-reference.md: method details
- references/standards.md: STIX, TAXII, ATT&CK, TLP context
What people use it for
- Writing the attribution section of an incident report with a stated confidence level.
- Comparing infrastructure and tooling between two intrusions to see if they share an operator.
- Ranking several candidate threat groups against the same evidence set using ACH.
- Teaching students how ACH and the Diamond Model are applied to a real case.
- Mapping observed behaviour to MITRE ATT&CK techniques to compare against known actor profiles.
Frequently asked questions
How do I install the campaign attribution analysis skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, upload it under Settings → Capabilities → Skills.
What do I need to run it?
The skill lists Python 3.9 or newer with attackcti, stix2, networkx and requests. Access to MISP or OpenCTI is optional. It runs bundled scripts and uses the network.
Is the skill free to use?
The skill is listed under the Apache-2.0 licence. Read the licence file in the download for the terms that apply to your use.
Can this tell me for certain which group attacked us?
No. The skill's scoring weights and thresholds are heuristic, and it does not validate evidence. It is meant to structure analyst judgement and give a defensible confidence level, not to prove responsibility.
Why does the agent say confidence is LOW even with some matches?
The ACH code labels a score below 40 as LOW, and scores depend on fixed weights for each piece of evidence. Missing or inconsistent evidence lowers the score, so add more verified indicators or check for inconsistencies.
Does it work outside Claude?
The source describes installing it into Claude's skills folders and the Claude apps. It does not describe support for other agent platforms, so check the documentation of any other tool before relying on it.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a threat intelligence analyst, incident responder or student who needs a structured, transparent way to weigh attribution evidence and state a confidence level. Pick something else if you need a legal or public attribution decision or a quick triage tool that runs without analyst review, since the fixed-weight scoring can mislead on incomplete inputs.
Download the skill