Who Did It? Getting Started with Threat Actor Profiling
summary
Introduces PACT as a stepwise profiling workflow: detect the incident, collect and label evidence with an admiralty code, then analyze in three concurrent stages — victimology + crime‑scene assessment + offender characteristics — where technical TTPs map to MITRE ATT&CK and the offender profile captures capability, resources, and motivation. Optionally compare the profile against a database with a likelihood matrix. Notes practical gaps: no shared database yet, scarce/ad-hoc data, legal barriers to collaboration, and opportunities for AI to automate comparisons.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 3:14Attribution in cyber attacks
- 6:24Profiling model limits
- 8:55PACK model framework
- 11:48PACK model step by step
- 14:39CrashOverride case study
- 18:32Profile comparisons
- 21:01Model challenges
- 23:32Q&A
- 23:53Model availability
- 24:56Future collaboration
- 25:38Model in incident response
- 26:42Model outputs
- 27:02Closing
related talks
27mRevisiting Known Perps: Behavioral Profiling for Continuous Monitoring of Threat Actors
13mAPTGen: An Approach towards Generating Practical Dataset Labelled with Targeted...
23mData Driven APT Attribution and AI/ML Research
21mAdvanced Cyber Threat Intelligence Chapter - How to Read the Mind of your Attackers
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
37mThreats versus Capabilities Building Better Detect and Respond Capabilities
34mThere is No TTP
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity