Campaign Attribution Analysis
Weighs cyber-campaign evidence to assess which threat actor is likely responsible, with confidence levels.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
Once installed, the agent follows a structured method for working out which threat group may be behind a cyber operation. It uses the Diamond Model and Analysis of Competing Hypotheses to score infrastructure overlaps, technique (TTP) matches, malware code similarity, timing and language clues, and produces a confidence-rated assessment. Its bundled Python scripts can rank competing actor hypotheses and compare infrastructure between campaigns.
Great for
- Threat intelligence analysts writing attribution sections of incident reports
- Incident responders who need a defensible confidence level for an investigation
- Students learning structured analytic techniques like ACH
Skip it if
- Legal or public attribution decisions: the scoring weights and thresholds are heuristic and the skill does not validate evidence, so results should not be treated as proof of responsibility
- Quick triage without analyst review: scripts use simple fixed weights that can mislead if inputs are incomplete or biased
Try asking
- “Compare the infrastructure of two intrusion campaigns and tell me whether the overlap suggests a shared actor”
- “Rank these three candidate threat groups against the evidence I've collected using ACH”
- “Map this campaign's ATT&CK techniques against the known profile of APT29 and summarize the consistency”
- “Build a Diamond Model summary for this incident with confidence levels for each dimension”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
analyzing-campaign-attribution-evidence.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-campaign-attribution-evidence.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-campaign-attribution-evidence.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Give the agent structured evidence with a category, description and confidence for each item so the ACH scoring has inputs to work with
- Treat the output as an analyst-reviewed draft and document the evidence and alternative hypotheses behind any confidence level
- Review the scoring weights in scripts/agent.py and scripts/process.py before relying on them for a formal report
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.