gensecaihq/wazuh-autopilot/threat-actor-attribution

Threat Actor Attribution

Attribution is rarely needed to respond, and wrong attribution causes real harm (misdirected response, bad executive decisions). Do it carefully or not at all.

When to attempt

Attempt only if at least two of these hold:

• Infrastructure (IP/domain) with a reliable (A/B) public link to a named cluster.
• Tooling or malware family with known actor associations.
• A distinctive TTP sequence matching an ATT&CK group profile.
• Targeting consistent with the actor's known sector/geography interest.

Otherwise record "attribution not assessed — insufficient evidence" and stop.

Diamond Model

Describe the intrusion on four vertices and the links between them:

Meta-features: timestamp, phase (ATT&CK tactic), result, direction, methodology. Pivot vertex-to-vertex (e.g. infrastructure → other victims seen in intel) to test links.

Comparing to ATT&CK groups

1. List the case's confirmed techniques (from mitre-attack-mapping).
2. Compare with candidate groups' technique sets from public ATT&CK group pages

(via search_external_context for the group name — public data only).

1. Overlap on common techniques (T1059, T1078, T1110) means little; weight distinctive

techniques and tool names higher.

1. Record competing hypotheses, including "unknown / commodity actor".

Estimative language (ICD 203 style)

Use consistent probability terms and state confidence separately:

Confidence (low / moderate / high) reflects evidence quality and source reliability, not probability. Example: "We assess it is unlikely (moderate confidence) that this activity is linked to group X; infrastructure overlap is limited to a shared hosting provider."

Rules

• Never name a nation-state sponsor on your own; at most reference public reporting and

grade it.

• Distinguish commodity crimeware, opportunistic scanning, and targeted operations.
• Attribution never changes containment urgency by itself.

Output

• add_finding titled Attribution assessment with the Diamond Model table, competing

hypotheses with estimative language and confidence, sources with Admiralty grades, and key gaps. standard_refs: MITRE-ATTACK.