<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: threat-modeling
description: >-
  Comprehensive threat modeling methodologies including STRIDE, PASTA, LINDDUN, OCTAVE,
  attack trees, kill chain analysis, abuse case modeling, data flow diagram analysis,
  MITRE ATT&CK-driven threat modeling, threat library management, and continuous
  threat modeling automation. Use when asked about threat identification, risk analysis,
  attack path enumeration, privacy threat modeling, or systematic threat assessment.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - stride
  - pasta
  - linddun
  - octave
  - attack-trees
  - kill-chain
  - abuse-cases
  - dfd-analysis
  - mitre-attack
  - threat-library
  - continuous-threat-modeling
  - threat-automation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1190", "T1078", "T1059", "T1021", "T1557", "T1053"]
  nist-csf: ["ID.RA", "ID.AM", "PR.IP", "DE.AE", "RS.AN"]
  frameworks: ["STRIDE", "PASTA", "LINDDUN", "OCTAVE", "MITRE ATT&CK", "Cyber Kill Chain"]
---

# Threat Modeling

## When to Use

- Systematic threat identification for new or existing systems
- STRIDE, PASTA, LINDDUN, or OCTAVE methodology application
- Attack tree construction and kill chain analysis
- Data flow diagram security analysis
- Privacy-focused threat modeling (LINDDUN)
- MITRE ATT&CK-mapped threat enumeration
- Abuse case and misuse case development
- Threat library creation and management
- Continuous threat modeling in CI/CD pipelines
- Risk-centric threat assessment and prioritization

## Prerequisites

- System architecture documentation or data flow diagrams
- `pytm` for programmatic threat models: `pip install pytm`
- Graphviz for DFD rendering: `apt install graphviz`
- Python 3.10+ for automation scripts
- OWASP Threat Dragon for collaborative modeling
- MITRE ATT&CK Navigator for coverage mapping

## Quick Reference

| Methodology | Focus | Best For |
|-------------|-------|----------|
| STRIDE | Per-element threat categorization | Component-level analysis |
| PASTA | Risk-centric 7-stage process | Business-aligned threat analysis |
| LINDDUN | Privacy threat categories | GDPR/privacy compliance |
| OCTAVE | Organizational risk assessment | Enterprise risk management |
| Attack Trees | Hierarchical goal decomposition | Attack path enumeration |
| Kill Chain | Sequential attack phase mapping | Intrusion analysis |
| Abuse Cases | Misuse scenario modeling | Requirements-phase security |
| MITRE ATT&CK | TTP-based threat mapping | Detection coverage gaps |

## Workflow

### 1. Select Methodology

Choose based on context:
- **Component-level threats** → STRIDE per-element
- **Business risk alignment** → PASTA 7-stage
- **Privacy requirements** → LINDDUN
- **Enterprise risk posture** → OCTAVE
- **Attack path analysis** → Attack Trees + Kill Chain
- **Detection engineering** → MITRE ATT&CK mapping

### 2. Build System Model

1. Identify external entities, processes, data stores, data flows
2. Draw trust boundaries at network, privilege, and classification transitions
3. Document authentication, encryption, and authorization at each boundary
4. Validate model with development and operations teams

### 3. Enumerate Threats

1. Apply selected methodology systematically to each component
2. Score threats using DREAD, CVSS, or risk matrix
3. Map to MITRE ATT&CK TTPs for detection coverage
4. Prioritize by business impact and exploitability

### 4. Mitigate and Track

1. Assign mitigations to each HIGH/CRITICAL threat
2. Map controls to implementation tickets with owners
3. Verify mitigations through testing and review
4. Integrate into CI/CD for continuous validation

## Techniques

This domain includes 12 specialized techniques:

| Technique | Description |
|-----------|-------------|
| `performing-stride-analysis` | STRIDE per-element threat categorization |
| `building-attack-trees` | Hierarchical attack goal decomposition |
| `performing-pasta-methodology` | 7-stage risk-centric threat analysis |
| `implementing-threat-modeling-automation` | CI/CD-integrated automated threat modeling |
| `performing-data-flow-diagram-analysis` | DFD-based security boundary analysis |
| `building-abuse-case-models` | Misuse and abuse scenario modeling |
| `performing-linddun-privacy-threat-modeling` | Privacy-focused threat identification |
| `implementing-threat-library-management` | Organizational threat catalog management |
| `performing-mitre-attack-threat-modeling` | ATT&CK TTP-mapped threat enumeration |
| `building-kill-chain-analysis` | Cyber Kill Chain phase mapping |
| `performing-octave-risk-assessment` | OCTAVE organizational risk assessment |
| `implementing-continuous-threat-modeling` | Living threat models with change triggers |

## Verification

- [ ] Methodology selected matches engagement context and objectives
- [ ] System model includes all components, flows, and trust boundaries
- [ ] Threats enumerated for every element crossing a trust boundary
- [ ] All HIGH/CRITICAL threats have mitigations with owners and timelines
- [ ] Threat model reviewed by development, security, and operations teams
- [ ] Findings mapped to MITRE ATT&CK for detection coverage analysis
- [ ] Threat model integrated into change management process

## Quick Reference

```bash
# List techniques
ls skills/threat-modeling/techniques/
```

## References

- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)
- [Microsoft STRIDE](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)
- [PASTA Threat Modeling](https://versprite.com/tag/pasta-threat-modeling/)
- [LINDDUN Privacy Threats](https://linddun.org/)
- [OCTAVE Method](https://www.sei.cmu.edu/our-work/products/octave/)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [pytm Documentation](https://github.com/OWASP/pytm)
