菜单
This skill should be used when building attack trees, when the user mentions "attack tree", "attack path", "AND/OR tree", "threat tree", "multi-step attack", or needs to construct structured attack decompositions.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
This skill should be used when creating data flow diagrams, when the user mentions "DFD", "data flow diagram", "trust boundaries", "data flows", "Mermaid diagram", or needs to visualize how data moves through the system.
This skill should be used when mapping threats to MITRE ATT&CK techniques, when the user mentions "ATT&CK", "MITRE", "T-codes", "attack techniques", "tactics and techniques", "kill chain", or needs to reference the ATT&CK Enterprise framework for threat classification.
This skill should be used when the user mentions "PASTA", "threat modeling methodology", "Process for Attack Simulation", "7-stage threat model", "OWASP threat modeling", or needs to understand the PASTA framework stages, outputs, and how they connect.
This skill should be used when classifying threats using STRIDE methodology, when the user mentions "STRIDE", "spoofing threats", "tampering threats", "repudiation", "information disclosure", "denial of service", "elevation of privilege", or needs to categorize security threats by type.
| name | Attack Tree Generation |
| description | This skill should be used when building attack trees, when the user mentions "attack tree", "attack path", "AND/OR tree", "threat tree", "multi-step attack", or needs to construct structured attack decompositions. |
| version | 1.0.0 |
Build structured AND/OR attack trees that decompose high-level threat goals into concrete, actionable attack steps aligned with the VerSprite model.
| Type | Symbol | Meaning | Probability Rule |
|---|---|---|---|
| AND | All children required | Attacker must complete ALL sub-steps | P = P(child1) * P(child2) * ... |
| OR | Any child sufficient | Attacker can use ANY sub-path | P = max(P(child1), P(child2), ...) |
| LEAF | Terminal step | Concrete technique, no decomposition | P from 5-factor model |
| Level | Role | Description | Example |
|---|---|---|---|
| 0 | threat-motive | Root: attacker's goal | "Steal payment card data" |
| 1 | threat-agent | Who performs the attack | "External attacker (financially motivated)" |
| 2 | target | What is being attacked | "Payment API, card database" |
| 3 | attack-vector | Delivery mechanism | "Network access, social engineering" |
| 4 | attack-pattern | Specific CAPEC pattern | "CAPEC-66: SQL Injection" |
Start with the threat scenario goal from STRIDE analysis.
Who would pursue this goal? Multiple agents = OR node (any agent can attack).
What components must be compromised? Multiple sequential targets = AND node.
How can each target be reached? Multiple vectors = OR node (alternative paths).
What specific technique is used? Reference ATT&CK T-codes and CAPEC patterns.
graph TD
root["<b>Steal User Data</b><br/>threat-motive<br/>P=0.52"]
root -->|OR| path1["SQL Injection Path<br/>P=0.52"]
root -->|OR| path2["Credential Theft Path<br/>P=0.38"]
path1 -->|AND| step1a["Discover injection point<br/>T1190<br/>P=0.8"]
path1 -->|AND| step1b["Extract data<br/>T1005<br/>P=0.65"]
path2 -->|AND| step2a["Brute-force login<br/>T1110<br/>P=0.6"]
path2 -->|AND| step2b["Escalate to admin<br/>T1068<br/>P=0.4"]
path2 -->|AND| step2c["Export user table<br/>T1567<br/>P=0.7"]
style root fill:#ff6b6b
style path1 fill:#ffa07a
style path2 fill:#ffa07a
For the SQL Injection path (AND):
For the Credential Theft path (AND):
Root (OR): P = max(0.52, 0.17) = 0.52