메뉴
This skill should be used when building attack trees, when the user mentions "attack tree", "attack path", "AND/OR tree", "threat tree", "multi-step attack", or needs to construct structured attack decompositions.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
This skill should be used when creating data flow diagrams, when the user mentions "DFD", "data flow diagram", "trust boundaries", "data flows", "Mermaid diagram", or needs to visualize how data moves through the system.
This skill should be used when mapping threats to MITRE ATT&CK techniques, when the user mentions "ATT&CK", "MITRE", "T-codes", "attack techniques", "tactics and techniques", "kill chain", or needs to reference the ATT&CK Enterprise framework for threat classification.
This skill should be used when the user mentions "PASTA", "threat modeling methodology", "Process for Attack Simulation", "7-stage threat model", "OWASP threat modeling", or needs to understand the PASTA framework stages, outputs, and how they connect.
This skill should be used when classifying threats using STRIDE methodology, when the user mentions "STRIDE", "spoofing threats", "tampering threats", "repudiation", "information disclosure", "denial of service", "elevation of privilege", or needs to categorize security threats by type.
| name | Attack Tree Generation |
| description | This skill should be used when building attack trees, when the user mentions "attack tree", "attack path", "AND/OR tree", "threat tree", "multi-step attack", or needs to construct structured attack decompositions. |
| version | 1.0.0 |
Build structured AND/OR attack trees that decompose high-level threat goals into concrete, actionable attack steps aligned with the VerSprite model.
| Type | Symbol | Meaning | Probability Rule |
|---|---|---|---|
| AND | All children required | Attacker must complete ALL sub-steps | P = P(child1) * P(child2) * ... |
| OR | Any child sufficient | Attacker can use ANY sub-path | P = max(P(child1), P(child2), ...) |
| LEAF | Terminal step | Concrete technique, no decomposition | P from 5-factor model |
| Level | Role | Description | Example |
|---|---|---|---|
| 0 | threat-motive | Root: attacker's goal | "Steal payment card data" |
| 1 | threat-agent | Who performs the attack | "External attacker (financially motivated)" |
| 2 | target | What is being attacked | "Payment API, card database" |
| 3 | attack-vector | Delivery mechanism | "Network access, social engineering" |
| 4 | attack-pattern | Specific CAPEC pattern | "CAPEC-66: SQL Injection" |
Start with the threat scenario goal from STRIDE analysis.
Who would pursue this goal? Multiple agents = OR node (any agent can attack).
What components must be compromised? Multiple sequential targets = AND node.
How can each target be reached? Multiple vectors = OR node (alternative paths).
What specific technique is used? Reference ATT&CK T-codes and CAPEC patterns.
graph TD
root["<b>Steal User Data</b><br/>threat-motive<br/>P=0.52"]
root -->|OR| path1["SQL Injection Path<br/>P=0.52"]
root -->|OR| path2["Credential Theft Path<br/>P=0.38"]
path1 -->|AND| step1a["Discover injection point<br/>T1190<br/>P=0.8"]
path1 -->|AND| step1b["Extract data<br/>T1005<br/>P=0.65"]
path2 -->|AND| step2a["Brute-force login<br/>T1110<br/>P=0.6"]
path2 -->|AND| step2b["Escalate to admin<br/>T1068<br/>P=0.4"]
path2 -->|AND| step2c["Export user table<br/>T1567<br/>P=0.7"]
style root fill:#ff6b6b
style path1 fill:#ffa07a
style path2 fill:#ffa07a
For the SQL Injection path (AND):
For the Credential Theft path (AND):
Root (OR): P = max(0.52, 0.17) = 0.52