---
name: threat-intelligence
description: >
  Correlate malware analysis findings with threat intelligence sources. Use when
  mapping observed behaviors to MITRE ATT&CK, attributing malware to threat
  actors or campaigns, enriching IOCs with external intelligence, or assessing
  strategic threat context.
---

# Threat Intelligence Correlation

Systematic approach to contextualizing malware analysis findings with threat intelligence.

## When to Use

- Map observed malware behaviors to MITRE ATT&CK
- Attribute malware to known threat actors or campaigns
- Enrich IOCs with external intelligence sources
- Assess strategic significance of findings
- Track campaign infrastructure evolution

## Prerequisites

- **Python 3.10+** with `json` (standard library)
- **MITRE ATT&CK framework** knowledge for TTP mapping
- **API keys** (via environment variables) for one or more intelligence sources: VirusTotal, OTX AlienVault, AbuseIPDB, Shodan
- **IOCs and behavioral observations** from prior analysis stages (e.g., `ioc-extraction` output)

## Step-by-Step Instructions

### Step 1: Map to MITRE ATT&CK

```bash
# Map observed behaviors to ATT&CK techniques
python3 scripts/attack_mapper.py --behaviors behaviors.json --output attack_mapping.json

# Or provide behaviors inline
python3 scripts/attack_mapper.py --techniques T1566.001,T1059.001,T1547.001
```

Document each mapping with:
- Technique ID and name
- Observed evidence supporting the mapping
- Confidence level (high/medium/low)

### Step 2: Enrich IOCs

```bash
# Enrich IOCs with threat intelligence
python3 scripts/threat_enrichment.py --iocs ioc_list.json --output enriched.json

# Supports: VirusTotal, OTX AlienVault, AbuseIPDB, Shodan
# Requires API keys via environment variables
# Falls back gracefully when APIs unavailable
```

### Step 3: Search for Related Intelligence

Query threat intelligence sources for:
- **Hash lookups**: Known family/campaign association
- **Domain/IP reputation**: Hosting history, related malware
- **YARA rule matches**: Similarity to known threats
- **Code similarity**: Shared code with known families

### Step 4: Attribution Assessment

Consider multiple attribution indicators:

**Strong indicators:**
- Code signing certificates matching known threat actor
- Shared C2 infrastructure with attributed campaigns
- Identical custom tools/implants
- Language artifacts (compiler, debug strings, locale)

**Weak indicators (corroborate, don't rely on alone):**
- Similar TTPs (can be copied)
- Geographic targeting (multiple actors target same regions)
- Time-of-day activity (can be manipulated)
- False flags (deliberately planted attribution)

### Step 5: Campaign Tracking

If part of a broader campaign:
1. Identify campaign infrastructure (domains, IPs, certificates)
2. Track infrastructure changes over time
3. Correlate with other incidents using same infrastructure
4. Map campaign timeline and evolution
5. Identify victim profile/targeting pattern

### Step 6: Strategic Assessment

Provide context:
- Threat actor motivation (financial, espionage, sabotage, hacktivism)
- Target sector/geography alignment
- Sophistication level
- Operational tempo
- Likely next steps based on historical patterns

### Step 7: Defensive Recommendations

Based on ATT&CK mapping:
- Detection rules for each observed technique
- Monitoring recommendations per data source
- Mitigation controls per ATT&CK technique
- Priority based on technique prevalence and impact

## Intelligence Sources

### Open Source (Free)
| Source | Type | Best For |
|--------|------|---------|
| MITRE ATT&CK | Framework | TTP mapping |
| VirusTotal | File/URL/IP intel | Sample and IOC lookup |
| OTX AlienVault | Pulse-based intel | Community threat data |
| AbuseIPDB | IP reputation | Malicious IP identification |
| URLhaus | URL intel | Malware distribution URLs |
| Shodan | Internet scan data | Infrastructure analysis |
| CIRCL MISP | Sharing platform | Community threat sharing |

### Commercial
- CrowdStrike Falcon X
- Recorded Future
- Mandiant Advantage
- ThreatConnect
- IBM X-Force Exchange

## Confidence Levels

| Level | Criteria |
|-------|---------|
| **High** | Multiple independent sources confirm; strong technical evidence |
| **Medium** | Some corroborating evidence; technical indicators align |
| **Low** | Single source or circumstantial evidence; alternative explanations exist |

## Related Skills

- `mitre-attack-mapping` — Detailed ATT&CK technique mapping
- `ioc-extraction` — Extract indicators for enrichment
- `stix-report-generation` — Format intelligence in STIX 2.1
- `malware-report-writing` — Include intel context in reports