Threat Actor Profiling Skill

Generate structured, actionable threat actor profiles following a deliverable-first methodology grounded in the 5W1H framework and the Diamond Model of Intrusion Analysis.

When to Use

• User asks to profile or research a threat actor / APT group
• User needs to produce an intelligence deliverable about an adversary
• User wants to structure existing threat data into a TA profile
• User is responding to an RFI or incident involving a known threat actor
• User wants to assess capability, intent, or victimology of a group

Core Workflow

Follow these six steps in order. Each step builds toward a complete profile.

Step 1: Define Scope and Purpose

Before collecting any data, clarify: