attack-trees

Attack Trees

Attack tree construction methodology, notation, common patterns, and analysis techniques for decomposing complex threats into specific, analyzable attack paths.

Knowledge Base

What Are Attack Trees?

Attack trees are hierarchical diagrams that model the different ways an attacker can achieve a specific objective. The root node is the attacker's goal, intermediate nodes are subgoals, and leaf nodes are specific, atomic actions the attacker takes. Nodes are connected by AND gates (all children must succeed) or OR gates (any child is sufficient).

Attack trees were formalized by Bruce Schneier (1999) and remain one of the most practical tools for understanding and communicating about security threats.

Tree Notation

Text-based notation (used in this plugin):

[ROOT GOAL] (OR)                          # Attacker wants to achieve this
├── [Subgoal A] (AND)                     # Approach A requires all steps
│   ├── [Action A.1] {leaf}               # Specific atomic action
│   └── [Action A.2] {leaf}               # Both A.1 AND A.2 needed
├── [Subgoal B] (OR)                      # Approach B has alternatives
│   ├── [Action B.1] {leaf}               # B.1 alone is sufficient
│   └── [Action B.2] {leaf}               # OR B.2 alone is sufficient
└── [Subgoal C] {leaf}                    # Sometimes a single action is enough

Node annotations:

[Action] {leaf}
  Cost: $ / $$ / $$$ / $$$$ / $$$$$      # Resources attacker needs to spend
  Skill: Novice / Intermediate / Expert    # Required attacker skill level
  Time: Minutes / Hours / Days / Weeks     # Time to execute
  Detect: Low / Medium / High              # Probability of detection
  Control: [Name] or NONE                  # Existing security control
  ATT&CK: T[xxxx]                         # MITRE ATT&CK technique ID

Common Attack Tree Templates

Account Takeover

[Take Over User Account] (OR)
├── [Steal Credentials] (OR)
│   ├── [Phishing] (AND)
│   │   ├── [Send convincing phishing email] {leaf}
│   │   │   Cost: $, Skill: Novice, Time: Hours, Detect: Medium
│   │   └── [Victim enters credentials on fake page] {leaf}
│   │       Cost: $, Skill: N/A (victim action), Detect: Low
│   ├── [Credential Stuffing] (AND)
│   │   ├── [Obtain leaked credential database] {leaf}
│   │   │   Cost: $, Skill: Novice, Time: Minutes, Detect: Low
│   │   └── [Automate login attempts] {leaf}
│   │       Cost: $, Skill: Novice, Time: Hours, Detect: High
│   │       Control: Rate limiting, account lockout
│   ├── [Keylogger/Malware] (AND)
│   │   ├── [Deliver malware to victim device] {leaf}
│   │   │   Cost: $$, Skill: Intermediate, Time: Days, Detect: Medium
│   │   └── [Capture credentials from keystrokes] {leaf}
│   │       Cost: $, Skill: Intermediate, Time: Hours, Detect: Low
│   └── [Network Sniffing] (AND)
│       ├── [Position on victim's network] {leaf}
│       │   Cost: $$, Skill: Intermediate, Time: Hours, Detect: Low
│       └── [Intercept cleartext credentials] {leaf}
│           Cost: $, Skill: Intermediate, Time: Minutes, Detect: Low
│           Control: TLS encryption
├── [Exploit Authentication Weakness] (OR)
│   ├── [Brute Force Weak Password] {leaf}
│   │   Cost: $, Skill: Novice, Time: Hours, Detect: High
│   │   Control: Password policy, rate limiting
│   ├── [Exploit Password Reset Flow] (AND)
│   │   ├── [Discover user's email address] {leaf}
│   │   └── [Exploit weak reset token generation] {leaf}
│   │       Control: Cryptographic random tokens
│   └── [Session Hijacking via XSS] (AND)
│       ├── [Find XSS vulnerability] {leaf}
│       │   Cost: $$, Skill: Intermediate, Time: Hours, Detect: Low
│       └── [Steal session cookie] {leaf}
│           Cost: $, Skill: Intermediate, Time: Minutes, Detect: Low
│           Control: HttpOnly cookies, CSP
├── [Bypass MFA] (OR)
│   ├── [SIM Swap (SMS-based MFA)] {leaf}
│   │   Cost: $$, Skill: Intermediate, Time: Days, Detect: Medium
│   ├── [Real-time Phishing Proxy (evilginx2)] {leaf}
│   │   Cost: $$, Skill: Expert, Time: Hours, Detect: Medium
│   └── [Social Engineer Help Desk] {leaf}
│       Cost: $, Skill: Intermediate, Time: Hours, Detect: Medium
│       Control: Identity verification procedures
└── [Insider Access] (OR)
    ├── [Malicious Administrator] {leaf}
    │   Cost: $, Skill: Novice, Time: Minutes, Detect: Medium
    │   Control: Audit logging, least privilege, separation of duties
    └── [Bribe/Coerce Employee] {leaf}
        Cost: $$$, Skill: Novice, Time: Days, Detect: Low