Building Attack Trees

name: building-attack-trees description: >- Construct hierarchical attack trees that decompose adversary goals into sub-goals, leaf nodes represent atomic attack steps, with AND/OR logic gates for comprehensive attack path enumeration and cost-benefit analysis. domain: cybersecurity subdomain: threat-modeling tags: - attack-trees - attack-paths - goal-decomposition - risk-analysis - threat-enumeration version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1078", "T1059", "T1053", "T1021"]

Building Attack Trees

Overview

Attack trees are hierarchical diagrams that model how an adversary achieves a goal by decomposing it into sub-goals connected by AND/OR gates. This technique covers tree construction, probability and cost annotation, path enumeration, and countermeasure mapping.

Mode: [MODE: RED] — Offensive attack path analysis and enumeration.

Prerequisites

• Target system documentation or architecture diagrams
• Python 3.10+ for tree analysis scripts
• Graphviz for tree visualization: apt install graphviz
• Understanding of the adversary's capabilities and objectives

Key Concepts

Attack Tree Structure

• Root node: Adversary's ultimate goal (e.g., "Exfiltrate customer PII")
• OR nodes: Alternative attack paths (attacker needs ANY one)
• AND nodes: Required combined steps (attacker needs ALL)
• Leaf nodes: Atomic attack actions with cost/probability annotations

Node Annotations

Path Analysis

For each root-to-leaf path:

• AND paths: multiply probabilities, sum costs
• OR paths: take maximum probability, minimum cost
• Optimal attack: lowest cost path with highest success probability

Workflow

Step 1: Define Root Goal

# Initialize attack tree with root goal
node scripts/agent.js --action build --goal "Exfiltrate customer PII"

Step 2: Decompose Into Sub-Goals

# Add nodes to the tree
node scripts/agent.js --action add-node --parent root --name "Compromise web app" --gate OR
node scripts/agent.js --action add-node --parent root --name "Insider threat" --gate OR

Step 3: Annotate and Analyze

# Analyze all attack paths
node scripts/agent.js --action analyze --input tree.json --output analysis.json

# Export tree visualization
node scripts/agent.js --action export --input tree.json --format dot

Step 4: Map Countermeasures

# Generate countermeasure report
node scripts/agent.js --action countermeasures --input tree.json --output mitigations.json

Verification

• Root goal clearly defined from adversary perspective
• All leaf nodes represent atomic, actionable attack steps
• AND/OR gates correctly model dependency relationships
• Cost and probability annotations on all leaf nodes
• All viable attack paths enumerated and ranked
• Countermeasures mapped to highest-risk paths

References

• Bruce Schneier — Attack Trees
• OWASP Attack Tree
• MITRE ATT&CK