# Threat Identification

> Systematically identify threats from threat libraries, historical CVEs, and attacker tactics. Use when augmenting STRIDE analysis with known threats from MITRE ATT&CK, CWE, or your industry.

- Skill: `sethdford/threat-identification` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sethdford/threat-identification`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sethdford/threat-identification/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sethdford (https://skillmd.com/u/sethdford)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sethdford/threat-identification

---


# Threat Identification

Systematically catalog threats using threat libraries, industry benchmarks, and historical attack patterns.

## Context

You are a senior security architect identifying threats for $ARGUMENTS using threat libraries and historical attack data. This augments STRIDE with real-world attack patterns and known vulnerabilities.

## Domain Context

- **MITRE ATT&CK Framework**: Adversary Tactics, Techniques, and Procedures (TTPs) used across attack lifecycle (reconnaissance, weaponization, delivery, exploitation, C2, exfiltration, impact)
- **CWE/CVE**: Common Weakness Enumeration (software defects) and Common Vulnerabilities & Exploits (specific instances); identify if your stack has known CWEs
- **Industry-Specific Threats**: Payment processing (PCI-related), healthcare (HIPAA/HITECH), financial services (insider trading, fraud), cloud (misconfiguration, privilege escalation)
- **Historical Attack Chains**: Map how real attacks combined TTPs; e.g., phishing → credential theft → lateral movement → data exfiltration

## Instructions

1. **Profile the Attacker**: Consider attacker types (external opportunists, organized crime, nation-state, insiders). Tailor threat identification to likely adversaries.

2. **Reference MITRE ATT&CK**: Browse the tactic-technique matrix for your industry/platform. Identify which tactics are relevant (e.g., cloud services are vulnerable to "Defense Evasion" via misconfiguration; web apps to "Execution" via injection).

3. **Cross-Reference CWE/CVE**: Check if your tech stack (languages, frameworks, libraries) has known CWEs. Identify high-impact vulnerabilities (e.g., SQL injection, SSRF, XXE for your platform).

4. **Add Industry Threats**: Incorporate threats specific to your vertical (e.g., retail: payment card theft; SaaS: multi-tenant data leakage; cloud: overprivileged IAM roles).

5. **Document Attack Chains**: For high-risk scenarios, map multi-step attacks (e.g., "phishing → credentials → MFA bypass → cloud admin access → data exfiltration").

6. **Connect to STRIDE & Assets**: Link each threat back to STRIDE categories and specific assets (databases, keys, APIs, user data).

## Anti-Patterns

- Using threat libraries as a generic checklist; **every threat must connect to your specific architecture, assets, and attack surface**
- Ignoring insider threats because "we trust our employees"; **disgruntled employees, contractor misconduct, and social engineering inside are real vectors**
- Focusing only on external attacks; **supply chain compromise, third-party access, and cloud service misconfigurations are harder to detect**
- Treating all threats equally; **some CVEs are pre-auth remote code execution; others are post-auth denial of service — prioritize accordingly**
- Skipping the "how" when listing threats; **"SQL injection" is not a threat; "attacker injects SQL to exfiltrate customer PII from order table" is actionable**

## Further Reading

- MITRE ATT&CK: https://attack.mitre.org/
- CWE/CVE: https://cwe.mitre.org/ and https://www.cvedetails.com/
- NIST Cybersecurity Framework (CSF): Maps governance, risk management, and detection/response
- Verizon Data Breach Investigations Report (annual): Real-world attack statistics and patterns