| name | threat-model |
| description | Generate a threat model for the analyzed target. Use after ingesting a binary or source code to understand the threat landscape. |
| user-invocable | true |
Threat Model Generator
Generate a threat model for the current investigation.
Process
- Review the attack surface:
skwaq surface
- Review findings:
skwaq viz findings
- Identify threat actors (who would attack this?)
- Map attack vectors (how could they attack?)
- Assess risks using STRIDE methodology:
- Spoofing - can identity be faked?
- Tampering - can data be modified?
- Repudiation - can actions be denied?
- Information Disclosure - can data leak?
- Denial of Service - can it be crashed?
- Elevation of Privilege - can access be escalated?
- Prioritize threats by likelihood and impact
- Suggest mitigations for top threats