Threat Intelligence Pattern Analysis for Cyber Analysts
Extract, correlate, and attribute cyber threats using pattern analysis
What You Can Do
You can rapidly synthesize disparate threat intelligence sources—malware reports, network logs, SIGINT summaries, and technical indicators—to construct actionable threat narratives. The skill enables you to correlate new indicators (IPs, domains, file hashes) against known APT profiles, map threat actor techniques to the MITRE ATT&CK framework, assess attribution confidence with structured justification, and identify capability evolution patterns across campaigns. Output is formatted as threat profiles, TTP matrices, and indicator relationship maps suitable for leadership briefings and defensive operations.
Features
Cross-reference technical indicators and behavioral patterns against known threat actor profiles with confidence scoring
Map threat actor techniques to MITRE ATT&CK framework and identify capability evolution across campaigns
Automatically link IPs, domains, file hashes, and malware signatures to construct infrastructure reuse patterns
Generate structured justifications for attribution decisions with supporting evidence trails
Synthesize disparate intelligence into cohesive threat profiles including motivation, capability, and targeting patterns
Identify behavioral signatures characteristic of specific threat groups from unstructured data sources
Flag missing data points and recommend collection priorities based on attribution and TTP assessment gaps
Example Output
Example 1: APT Attribution Report
- Threat Actor: APT28 (Fancy Bear)
- Confidence: High (85%)
- Supporting Indicators: 3 infrastructure overlaps with known C2 servers, 2 matching malware signatures from previous campaigns, TTP alignment on 6/8 attack phases
- Key TTPs: Spear-phishing (T1566.002), Living off the Land (T1036.005), Lateral Movement via PsExec (T1570)
- Evidence: Domain registration timing matches 2022 operation; malware beacon pattern identical to GRU-attributed Sofacy toolkit
Example 2: TTP Evolution Timeline
- Campaign A (2021): Exploit CVE-2017-0199, Trickbot dropper → C2 beaconing
- Campaign B (2023): Exploit CVE-2022-1234, Emotet variant → Domain fronting evasion
- Evolution: Shift from exploitation persistence to living-off-the-land evasion; 40% increase in anti-forensics techniques
Example 3: Indicator Correlation Network
- IP 192.0.2.45 → Links to 3 malware samples → Connects to 5 known APT domains → Associates with 2 historical campaigns
What's Included
- SKILL.md instruction file with threat intelligence analysis framework:
- APT Profile Template: Standardized format for threat actor characteristics, motivation, capability assessment
- TTP Mapping Checklist: MITRE ATT&CK alignment guide with evidence requirements per technique
- Attribution Confidence Matrix: Scoring rubric and justification framework for confidence levels
- Indicator Correlation Worksheet: Structured format for linking technical indicators across campaigns
Who It's For
- Cyber Threat Intelligence Analysts — Synthesizing raw intelligence into structured threat assessments and attribution reports
- Incident Response Specialists — Correlating incident indicators to known threat actors and identifying TTP patterns
- Security Operations Managers — Generating threat briefings and attribution confidence assessments for leadership decision-making
- Intelligence Fusion Center Analysts — Correlating SIGINT, HUMINT, and technical indicators across compartmented sources
- Defensive Operations Planners — Identifying capability evolution patterns to inform defensive prioritization and hardening strategies
Best For
- APT attribution and confidence assessment for incident investigations
- Bulk malware/network artifact analysis requiring rapid pattern extraction
- TTP mapping and MITRE ATT&CK framework alignment for threat actor profiles
- Indicator correlation across historical campaigns to identify infrastructure reuse
- Threat actor capability evolution analysis and targeting pattern identification
- Intelligence gap analysis and collection prioritization recommendations
You might also like
Streamline your systematic reviews by using Claude to screen abstracts against inclusion criteria, extract structured data from full texts, and synthesize findings across studies. Reduce manual screening time by 60-80% while maintaining rigorous documentation of your review methodology. Claude becomes your collaborative partner throughout the entire evidence synthesis workflow, from protocol planning to final data synthesis.
You receive a detailed systematic audit of your IRB protocol against federal regulations, institutional policies, and ethical standards. The skill identifies specific compliance gaps, maps findings to regulatory citations, and generates documented recommendations for remediation. You get a structured compliance assessment that pinpoints risk areas before submission or inspection.
Design comprehensive brand identity systems from scratch, including logos in 55+ styles, corporate identity programs with 50+ deliverables, design tokens and UI styling frameworks, professional banners in 22+ styles, custom SVG icons, and optimized social media assets across 8+ platforms. Claude generates production-ready files with mockups, specifications, and platform-specific formatting for immediate use.
You can rapidly analyze multiple research papers, extract quality metrics using evidence hierarchy frameworks, and generate structured literature syntheses. Claude evaluates study design, sample sizes, bias risk, and statistical significance to produce clinically actionable summaries that support evidence-based decision-making for healthcare providers and researchers.
Create professional banners, design systems, and brand-compliant content across multiple platforms. This comprehensive skill suite provides design intelligence for building UI/UX with systematic token architecture, component specifications, visual identity management, and AI-powered creative asset generation. Perfect for designing branded experiences with consistency, speed, and professional quality.
This skill guides you through a comprehensive peer review process using structured assessment templates, detailed evaluation rubrics, and evidence-based feedback frameworks. You'll generate detailed, constructive reviews that identify both strengths and weaknesses, provide actionable recommendations, and produce consistent evaluations suitable for academic journals, grant agencies, or conference committees.
This skill analyzes your academic manuscript and journal submission metadata against indexing standards from major databases (PubMed, Scopus, Web of Science, DOAJ). It identifies compliance gaps, recommends metadata improvements, optimizes keywords for discoverability, and validates citation formatting—helping your research reach the right audience and meeting publisher requirements on first submission.
This skill systematically reviews your research proposal against funder requirements, institutional policies, and compliance checkpoints to identify issues before submission. It validates proposal structure, budget justifications, and timelines while flagging common violations that could trigger desk rejections or revision requests. You'll receive a detailed compliance report with specific issues, severity levels, and actionable remediation steps for each funder type.