apt29

APT29 (Cozy Bear / Midnight Blizzard, SVR) adversary-emulation playbook — malware-light cloud-identity espionage: no-MFA password spray, OAuth consent/token abuse, Golden SAML, mailbox collection over residential proxies. Use when emulating APT29 against an M365/Entra/AWS-identity estate. Triggers on: 'emulate APT29', 'Cozy Bear', 'Midnight Blizzard', 'NOBELIUM', 'OAuth abuse', 'cloud identity espionage', 'Golden SAML'.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, actionable adversary-emulation playbook that sequences a multi-phase kill chain with concrete templates, named artifacts, and explicit safety/deconfliction gates. It is well-structured and lean, with only minor verbosity and notional referenced skill paths keeping it from the top anchor.

Suggestions

Tighten the opening blockquote and the 'recent_cti_delta' field in the ThreatProfile seed — the orientation partially repeats the frontmatter description.

Flag which downstream /skills/standard/.../SKILL.md paths are canonical vs. notional placeholders so the executing agent knows which to expect versus substitute.

Add an explicit validate-then-proceed loop for the canary-mailbox collection phase (e.g., confirm collected items are marked/canary before exfil) to strengthen the feedback loop.

Dimension	Reasoning	Score
Conciseness	Dense and efficient, assuming Claude knows MITRE techniques, OAuth, and SAML with no concept re-explanation; the opening blockquote and 'recent_cti_delta' field add minor redundancy that could be trimmed.	4 / 5
Actionability	Provides a copy-paste ThreatProfile JSON seed, named output files (conops.json, deconfliction.json, abort.json, cleanup.json), named tools, and specific downstream skill paths — concrete and specific, though some referenced skill paths are notional placeholders.	4 / 5
Workflow Clarity	Clear kill-chain sequence (numbered rows collapsed into a 5-phase CONOPS) with explicit safety checkpoints — written cloud-tenant authorization, EMERGENCY abort trigger, deconfliction pre-brief, and end-of-engagement cleanup; validation is present so no destructive-ops cap applies.	4 / 5
Progressive Disclosure	Well-organized into clearly headed sections with one-level-deep, clearly signaled references (apt-groups.md, downstream /skills/.../SKILL.md paths) and no nested reference chains; no bundle files exist to verify further.	4 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-structured description that concretely names the actor, its TTPs, the target estate, and a rich set of natural trigger phrases in third person. It cleanly answers both what the skill does and when to invoke it.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'no-MFA password spray, OAuth consent/token abuse, Golden SAML, mailbox collection over residential proxies' — giving comprehensive coverage of the actor's tradecraft rather than vague abstraction.	5 / 5
Completeness	Explicitly answers both what (adversary-emulation playbook for malware-light cloud-identity espionage with named TTPs) and when ('Use when emulating APT29 against an M365/Entra/AWS-identity estate'), plus a concrete 'Triggers on' clause.	5 / 5
Trigger Term Quality	Comprehensive natural triggers including synonyms and aliases a red-teamer would actually say — 'emulate APT29', 'Cozy Bear', 'Midnight Blizzard', 'NOBELIUM', 'OAuth abuse', 'cloud identity espionage', 'Golden SAML'.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear narrow niche (APT29/SVR cloud-identity espionage emulation) with distinct actor-specific triggers, making conflict with unrelated skills unlikely.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/soundwave/threat-profile/emulation/apt29/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.