Threat-Actor & TTP Attribution
Connect the behaviour to the name. This maps a named threat actor to the techniques it's known for, then pivots to other actors who share that same tradecraft — and, from a set of observed techniques, narrows down who's most likely responsible. The attribution view for turning 'how they operate' into 'who they are.'
How it uses the graph
Traverses the threat-intel layer of the graph, in 6 steps:
How it walks the graph6 steps
01Techniques used
Listing the actor's ATT&CK techniques…
threat-intel
02Other actors sharing those techniques
Finding other actors using those techniques…
threat-intel
03Techniques with ATT&CK tactics
Techniques with ATT&CK tactics…
threat-intel
04Tactic coverage across the kill chain
Tactic coverage across the kill chain…
threat-intel
05Discriminative power of the actor's techniques
Discriminative power of the actor's techniques…
threat-intel
06Candidate actors by rare-technique convergence
Candidate actors by rare-technique convergence…
threat-intel
Why each step runs
- 01Techniques used. Collects the actor's USES_TECHNIQUE set, the shared-tradecraft key the next step pivots on to widen the suspect pool.
- 02Other actors sharing those techniques. Pivots each technique back to other ACTORs and ranks them by overlap — the suspect-widening move that surfaces actors with similar tradecraft.
- 03Techniques with ATT&CK tactics. Lists each MITRE ATT&CK technique the named actor is known to use, tagged with the kill-chain tactic(s) it serves, so you see not just what tradecraft they use but where in the attack lifecycle it sits.
- 04Tactic coverage across the kill chain. Aggregates the actor's techniques by ATT&CK tactic to show which kill-chain phases they invest in most and where their operations concentrate.
- 05Discriminative power of the actor's techniques. Ranks each of the actor's techniques by how many other actors also use it: a technique shared by only one or two actors is a strong attribution fingerprint, while commodity tradecraft used by dozens of actors carries almost no discriminative value.
- 06Candidate actors by rare-technique convergence. Narrows attribution by scoring every other actor on how strongly its tradecraft converges on the rare techniques of the input actor: each shared technique is weighted by its rarity, so a few uncommon shared techniques rank an actor far above one sharing many commodity techniques.