# Threat Actor and Campaign Investigation

> Investigate adversaries by their behaviour: map intrusions to MITRE ATT&CK, model them with the Diamond Model, profile actors, track campaigns through infrastructure, and assess attribution claims with honest confidence.

Canonical: https://codelivly.com/learning-paths/cti-threat-actor-investigation
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Rooms | 5 |
| Lessons | 0 |

This learning path moves you from analysing single indicators to investigating adversaries and campaigns. You work through one connected set of fictional cases (the espionage cluster GRANITE HERON and its HARBORLIGHT campaign against maritime logistics firms, and the financially motivated phishing cluster TIDAL LYNX), using only synthetic data.

**Prerequisites.** Completion of *Threat Intelligence Foundations* (cti-foundations) and *OSINT and Indicator Analysis* (cti-osint-indicator-analysis), or equivalent experience: the intelligence lifecycle, confidence language, and pivoting on IPs, domains, certificates and passive DNS.

**Measurable outcomes.** After completing the path you can:

- Map intrusion observations to MITRE ATT&CK Enterprise v20 tactics, techniques and sub-techniques with cited evidence and confidence, and correct keyword mapping, over-mapping and tactic confusion.
- Build Diamond Model events, activity threads and activity groups from incident data, and pivot from one core feature to another.
- Write a threat actor profile that separates observed facts from assessed judgements, and explain why vendor cluster names do not map one to one.
- Grade attribution evidence by strength, reject weak associations (shared tooling, shared open-source malware, shared hosting, shared commercial kits) as attribution, and assign an explicit confidence level to an attribution claim.
- Cluster incidents into activity groups using infrastructure relationships, build UTC-normalised campaign timelines, and describe overlaps precisely.
- Investigate a phishing email (headers, SPF, DKIM and DMARC results, lure, redirect chain, credential harvesting kit) and extract campaign intelligence from a synthetic sandbox report.

**How you are assessed.** Each module has graded knowledge checks and at least one hands-on lab with bundled synthetic data. The path ends with a 23-question exam (pass mark 70 percent).

## Rooms in this path

1. [MITRE ATT&CK and Adversary Behavior Analysis](https://codelivly.com/rooms/cti-attack-behavior-analysis) - Read the ATT&CK knowledge base correctly, map real observations to tactics and techniques with evidence, and avoid the…
2. [The Diamond Model of Intrusion Analysis](https://codelivly.com/rooms/cti-diamond-model) - Structure intrusion evidence as Diamond events, link them into threads, pivot across infrastructure and capability, and…
3. [Threat Actor Profiling and Attribution Limitations](https://codelivly.com/rooms/cti-actor-profiling-and-attribution) - Build sourced actor profiles, read vendor naming overlaps correctly, and make attribution judgements at the right level…
4. [Campaign Tracking and Infrastructure Relationships](https://codelivly.com/rooms/cti-campaign-tracking) - Cluster intrusions into activity groups, read infrastructure relationships without false links, and track campaigns…
5. [Phishing and Malware Campaign Investigation](https://codelivly.com/rooms/cti-phishing-and-malware-campaigns) - Investigate phishing and malware campaigns from headers, authentication results, lures, redirect chains, phishing kits…

## Related

- [Career path: Threat Intelligence Analyst](https://codelivly.com/career-paths/threat-intelligence-analyst)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)
- [Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)