Profiling a Threat Actor From TTPs

When to Use

• You have a set of observed ATT&CK techniques from an intrusion and want to build a TTP profile and compare it against known-group technique sets for candidate attribution.
• You are estimating similarity, not asserting attribution.

Do not use technique overlap as confirmed attribution — many groups share common techniques. Present candidates with similarity scores and the need for corroborating intel.

Prerequisites

• Observed technique IDs from the intrusion and a reference of group→techniques (CSV/JSON).

Workflow

Step 1: Build the observed TTP profile

Collect the deduplicated set of observed ATT&CK technique IDs (including sub-techniques).

Step 2: Compare against known groups

python scripts/analyst.py compare --observed observed.txt --groups groups.json

Computes Jaccard and overlap-coefficient similarity between the observed set and each group's technique set, ranking candidate groups.

Step 3: Weigh distinctive techniques

Prioritize matches on less-common techniques (shared rare TTPs are stronger signals than ubiquitous ones).

Step 4: Document

Report ranked candidates with similarity scores, the overlapping techniques, and an explicit low/medium confidence — never definitive attribution from TTPs alone.

Validation

• Similarity is computed on technique-ID sets (sub-techniques included).
• Candidates are ranked by both Jaccard and overlap coefficient.
• Output states confidence and lists the overlapping techniques.

Pitfalls

• Over-attributing on common techniques (T1059, T1027) shared by most groups.
• Reference group data being incomplete or out of date.
• Treating a single high overlap as proof without corroborating intel.

References

• See references/api-reference.md for the comparison tool.
• ATT&CK Groups and Navigator references (linked in frontmatter).