'threat-actor' 검색 결과

Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Consolidating public information about an attacker group
• Comparing aliases, targets, and motivations across sources
• Mapping related domains, IP addresses, and infrastructure

Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Build a Python system that follows DNS history, domain registration records, and certificate information from known suspicious domains or IP addresses. Map related attack infrastructure, identify shared connections, and monitor for newly discovered domains matching known patterns.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding related domains from a known suspicious IP
• Mapping attacker command-and-control infrastructure
• Monitoring domains that match known naming patterns

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the user asks to build or update a threat-actor profile, "tell me about actor X" / "profile actor Y", or another skill needs the canonical profile template (attribution, TTPs, campaigns, infrastructure patterns, intelligence gaps).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when you need CrowdStrike Falcon Intelligence on an indicator (IOC reputation for an IP, domain, hash, or URL — malicious confidence, linked actors, malware families, reports) OR on an adversary (threat-actor profile, origin/target search, MITRE ATT&CK TTPs, finished intel reports). Answers questions like "look up 1.1.1.1", "what TTPs does Charming Kitten use?", "which threat actors operate from Russia?", and "latest report on Mustang Panda". Commonly invoked by the four /*-investigation skills, /ioc-enrichment-workflow, /threat-actor-profiling, and the regional espionage cells. Other agents/skills can chain this for vendor-authoritative actor and finished-intel context. Requires a Falcon Intelligence subscription.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profile and comparing it against known-group technique sets to estimate similarity and candidate attribution. Activates for requests to profile a threat actor, compare observed TTPs to known groups, or estimate attribution from technique overlap.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor beh

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor beh

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor beh

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Profiling the attack techniques used by a specific threat group
• Comparing techniques across multiple threat groups
• Finding detection gaps against a target adversary

Research malware families through Malpedia, connecting aliases, associated threat groups, and relationships between malware that loads other malware. Collect YARA rules, patterns used to identify malware, and organize references to support investigations and detection work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Resolving different vendor names for the same malware
• Mapping malware associated with a threat group
• Documenting chains in which malware loads other malware

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset types, severity rubric (CRITICAL/HIGH/MEDIUM/LOW/INFO), confidence upgrade workflows, time budgeting, asset-level triage rules, scale-based tactics, identity-fabric mapping (Entra/Okta/ADFS/Google/SAML/M365 Teams+SharePoint+OAuth), API and auth-map methodology, JavaScript deep analysis, mobile attack surface, cloud attack surface, breach×identity correlation, detectability tagging, detection-aware probing (back-off, persona rotation), read-only validator discipline, WAF/CDN bypass + origin discovery, vulnerability prioritization (CVE/EPSS/KEV), phishing infrastructure planning + pretext development, bug bounty submission templates, client deliverable templates with risk translation, threat-actor investigation (incl. RU/CN pivots), cryptocurrency tracing, image/video forensics, chronolocation. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, tracing crypto flows, geolocating media, or performing attribution work.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when you need to know where a piece of reporting actually came from — the user gives an article URL and asks "where does this come from?", "who is the original source?", "is this just a rewrite?", or another skill needs the provenance chain before grading or citing a report. Follows an article's links and named attributions back to the originating vendor, government, victim or actor document and returns the chain, the primary's stated access and confidence language, publication dates, and every hop it could not resolve. Deterministic — a script or the Liberty91 platform resolves the chain; the model does not reconstruct it from memory. Invoked by /quality-of-information-check, /threat-actor-profiling, /campaign-tracking and /intelligence-writing. Works on any URL with no API key.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the user asks about CTI standard operating procedures (daily triage, IOC processing, flash-report cadence, threat-actor profile updates, briefing schedule), or wants to look up a specific SOP.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when you need to check whether an organisation/domain has been claimed by a ransomware group, profile a specific ransomware group (TTPs, leak-site infra, IOCs, YARA), or aggregate ransomware victim claims by country/sector/timeframe. Backed by ransomware.live's leak-site scrapes — 27k+ victims across 330+ groups. Commonly invoked by /domain-investigation, /ransomware-ecosystem, /threat-actor-profiling, and detection-engineering workflows. Reads $RANSOMWARE_LIVE.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

CrowdStrike Falcon Intelligence (Intel API) reference. OAuth2 auth, Falcon Query Language, indicator (IOC) lookups, threat-actor entities, intel reports, MITRE ATT&CK mappings, malware families, vulnerabilities, rule sets.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when you need to answer "which attacker techniques do our controls actually stop, and how well?", "what controls should I have for this threat?", or "what telemetry should I collect to detect it?" — joining a customer's or your own security control baseline to ATT&CK techniques using a public, versioned evidence base of 9,545 control-to-technique mappings from six sources. Produces four ranked lists (addressed strongly, addressed weakly, real gaps, and techniques no control anywhere addresses). Use for control gap analysis, security programme prioritisation, board reporting on coverage, or the Resistance Strength side of a FAIR risk assessment. Invoke after /threat-actor-profiling or /lookup-liberty91 has produced a technique list.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.