STRIDE & MITRE ATT&CK Report

📊 Threat Statistics

Total Threats 73
Average Severity 9.02
Max Severity 10.00
Min Severity 7.00
Severity Distribution

CRITICAL 45

HIGH 23

MEDIUM 5

🎯 MITRE Techniques

Techniques Mapped

🛡️ STRIDE Distribution

Spoofing 17
Elevation of Privilege 17
Tampering 11
Information Disclosure 14
Repudiation 9
Denial of Service 5

📋 Executive Summary

10.0

Max Risk Score

9.0

Avg Risk Score

Critical Threats

High Threats

Total Threats

🔥 Top 5 Threats by Severity

#	Target	STRIDE	Severity	Description
1	End User	Spoofing	CRITICAL (10.0)	(AI) Credential Stuffing Attack Against OIDC Authentication: Attacker leverages credential reuse from other breaches to gain...
2	DevOps Engineer	Elevation of Privilege	CRITICAL (10.0)	(AI) SSH Key Theft and Lateral Movement to CI/CD Server: The DevOps Engineer's SSH session to the CI/CD server is protected...
3	CDN Load Balancer	Tampering	CRITICAL (10.0)	Unpatched OS or software vulnerabilities on CDN Load Balancer leading to system compromise
4	API Gateway	Tampering	CRITICAL (10.0)	Unpatched OS or software vulnerabilities on API Gateway leading to system compromise
5	API Gateway	Tampering	CRITICAL (10.0)	Event injection vulnerability in serverless function API Gateway, leading to arbitrary code execution.

🎯 Risk Matrix

Threats plotted by Impact (Y-axis, derived from severity score) vs Likelihood (X-axis, derived from risk signals: CVE + CWE + network exposure). Hover over a dot for details.

Impact ↑

← Likelihood →

Critical High Medium Low

📋 Model Completeness D · 50% ▶

50%

A higher completeness score improves threat detection accuracy, AI enrichment quality, and severity scoring.

Check	Score	Wt	Hint
Dataflows authenticated	0% (0/6)	15	Add is_authenticated=true to dataflows that require credentials or token-based auth to reduce false positives in threat scoring.
Dataflows encrypted	83% (5/6)	15	Add is_encrypted=true to dataflows that use TLS/SSH/IPSec. Unencrypted flows receive higher STRIDE scores.
Dataflows have protocol	100% (6/6)	10
Boundaries trust defined	100% (3/3)	15
Boundaries described	0% (0/3)	5	Add a description to boundaries (e.g. 'DMZ — internet-facing zone'). Descriptions improve AI prompt quality.
Servers have classification	0% (0/6)	15	Set classification= (PUBLIC/INTERNAL/RESTRICTED/SECRET) on servers. Classification affects severity scoring.
Servers described	0% (0/6)	5	Add description= to servers. Descriptions are used in AI prompts and improve threat specificity.
Actors described	0% (0/2)	5	Add description= to actors. Descriptions help the AI identify privilege levels and attack surfaces.
Model defines at least one boundary	✓	5
Model defines at least one dataflow	✓	5

🎯 CISO Risk Briefing

9.4

/ 10

CRITICAL

The organisation faces a CRITICAL security posture with multiple unmitigated high-severity threats enabling spoofing, tampering, and information disclosure. Critically, goal-driven attack scenarios for authentication bypass via OIDC misconfiguration and CI/CD server pivot to production microservices remain viable after Blue's defences, confirming active exploitability. Immediate investment in multi-factor authentication, patch management, and encryption of database connections is required to reduce existential risk to the business.

Top Findings

Spoofing and Authentication Bypass Across Trust Boundaries T-0001, T-0008, T-0009, T-0010, T-0011, T-0012 ⚡ GDAF-B2B36365
Multiple spoofing threats (T-0001, T-0008, T-0009, T-0010, T-0011, T-0012) combined with critical OIDC credential stuffing (T-0001) and weak API Gateway authentication expose the organisation to credential theft and unauthorized access. The GDAF-B2B36365 scenario for authentication bypass via OIDC misconfiguration remains viable after Blue's defences, confirming active exploitability. T-0012 further highlights the risk of single-factor authentication across the end user base.
Tampering and Data Integrity Compromise Across Core Services T-0003, T-0005, T-0006, T-0013, T-0014, T-0015, T-0016, T-0017, T-0018 ⚡ GDAF-D6767346
Critical tampering threats target the CDN Load Balancer, API Gateway, Auth Service, Product Microservice, and Product Database (T-0003 through T-0018). Unpatched OS vulnerabilities and injection flaws (SQL injection T-0017) enable data corruption, system compromise, and unauthorized command execution. The GDAF-D6767346 scenario for CI/CD server pivot to production microservices remains viable after Blue's defences, indicating that insider threat and ransomware paths to core data services are actively exploitable.
Information Disclosure and Insider Threat to Sensitive Data T-0007, T-0018, T-0019, T-0020 ⚡ GDAF-74EA3363
Critical information disclosure threats target credentials in dataflow (T-0007) and the Product Database (T-0019, T-0020). The GDAF-74EA3363 scenario for unencrypted database connection interception by a rogue DevOps engineer remains viable after Blue's defences, confirming that insider threat paths to sensitive data are actively exploitable. Combined with elevation of privilege risks, this creates a significant risk of regulatory and reputational damage.

Quick Wins

Action	Impact	Effort	Addresses
Enforce multi-factor authentication for all administrative and end-user accounts, and remediate weak authentication on API Gateway routes.	HIGH	MEDIUM	T-0001, T-0008, T-0009, T-0010, T-0011, T-0012
Patch all unpatched OS and software vulnerabilities on CDN Load Balancer, API Gateway, Auth Service, Product Microservice, and CI/CD Server.	HIGH	HIGH	T-0003, T-0004, T-0005, T-0006, T-0013, T-0014, T-0015, T-0016, T-0018
Encrypt all database connections and implement strict access controls to prevent insider threat interception of sensitive data.	HIGH	MEDIUM	T-0007, T-0018, T-0019, T-0020
Deploy input validation and parameterized queries to mitigate SQL injection and event injection vulnerabilities on the Product Database and API Gateway.	HIGH	MEDIUM	T-0017, T-0005
Harden CI/CD server configuration and segment DevOps-to-CICD trust boundaries to block lateral movement pathways.	HIGH	MEDIUM	T-0018, T-0019, GDAF-D6767346, GDAF-77FCFE51

🕸️ Threat Graph

Interactive attack-surface map. Click a node to list its threats. Node colour = highest severity. Edge style: solid = encrypted, dashed = plain.

⚡ Highlight GDAF attack path:

Click a node to see its threats.

CRITICAL HIGH MEDIUM LOW No threats ⬡ Server ○ Actor

⛓️ Attack Chain Analysis

Each row represents a potential pivot chain: an attacker compromises the Entry Point component via its highest-severity threat, then traverses the dataflow to exploit the Target component. Chains are ranked by average severity.

#	Chain Score	Entry Point	Dataflow / Protocol	Target	Entry Threat	Pivot Threat
1	CRITICAL (10.0)	End User	UserToGateway HTTPS	API Gateway	Spoofing (AI) Credential Stuffing Attack Against OIDC Authentication: Attacker leverages credential reuse...	Tampering Unpatched OS or software vulnerabilities on API Gateway leading to system compromise
2	CRITICAL (10.0)	API Gateway	GatewayToAuth HTTPS	Auth Service	Tampering Unpatched OS or software vulnerabilities on API Gateway leading to system compromise	Tampering Unpatched OS or software vulnerabilities on Auth Service leading to system compromise
3	CRITICAL (10.0)	API Gateway	GatewayToProductSvc HTTPS	Product Microservice	Tampering Unpatched OS or software vulnerabilities on API Gateway leading to system compromise	Tampering Unpatched OS or software vulnerabilities on Product Microservice leading to system compromise
4	CRITICAL (10.0)	Product Microservice	ProductSvcToDB TCP	Product Database	Tampering Unpatched OS or software vulnerabilities on Product Microservice leading to system compromise	Tampering Unpatched OS or software vulnerabilities on Product Database leading to system compromise
5	CRITICAL (10.0)	DevOps Engineer	DevOpsToCICD SSH	CI/CD Server	Elevation of Privilege (AI) SSH Key Theft and Lateral Movement to CI/CD Server: The DevOps Engineer's SSH session to...	Tampering Unpatched OS or software vulnerabilities on CI/CD Server leading to system compromise
6	CRITICAL (10.0)	CI/CD Server	CICDToProductSvc SSH	Product Microservice	Tampering Unpatched OS or software vulnerabilities on CI/CD Server leading to system compromise	Tampering Unpatched OS or software vulnerabilities on Product Microservice leading to system compromise

⚡ GDAF Attack Scenarios 7 Goal-Driven Attack Flows — click to expand

Objective-based attack paths computed by the Goal-Driven Attack Flow engine. Each scenario models a complete adversary journey from entry point to high-value target, with MITRE ATT&CK techniques assigned per hop. Sorted by path score (highest risk first).

#	Risk	Objective	Actor	Attack Path	Score	Hops	Detection
1 GDAF-B2B36365	HIGH	Authentication Bypass via OIDC Misconfiguration Attacker exploits a misconfiguration in the OIDC/OAuth2 flow — such as an...	External Attacker (Credential Stuffing + OWASP Exploitation) medium	API Gateway → Auth Service	3.72 🥊	2	65%
Business impact: Unauthorized access to all customer accounts; admin account takeover; full data breach Attack hops API Gateway [api-gateway] (entry) Protocol: https · no auth · hop score: 3.0 Techniques: T1190 — Exploit Public-Facing Application  \|  T1059 — Command and Scripting Interpreter  \|  T1078 — Valid Accounts Auth Service [auth-server] (target) Protocol: https · no auth · hop score: 4.44 Techniques: T1110 — Brute Force  \|  T1212 — Exploitation for Credential Access  \|  T1528 — Steal Application Access Token
2 GDAF-74EA3363	CRITICAL	Unencrypted Database Connection Interception Attacker who has gained a foothold within the Private App Zone (e.g. via a...	Rogue DevOps Engineer (Insider Threat) high	CI/CD Server → Product Microservice → Product Database	4.16 🥊	3	40%
Business impact: Mass PII/payment data exfiltration; PCI DSS breach; regulatory fines and customer notification Attack hops CI/CD Server [management-server] (entry) Protocol: ssh · no auth · hop score: 4.23 Techniques: T1078 — Valid Accounts  \|  T1021.001 — Remote Desktop Protocol  \|  T1570 — Lateral Tool Transfer Product Microservice [default] (intermediate) Protocol: ssh · no auth · hop score: 3.57 Techniques: T1078 — Valid Accounts  \|  T1195 — Supply Chain Compromise  \|  T1021 — Remote Services Product Database [database] (target) Protocol: tcp · cleartext · no auth · hop score: 4.68 Techniques: T1048 — Exfiltration Over Alternative Protocol  \|  T1552 — Unsecured Credentials  \|  T1030 — Data Transfer Size Limits
3 GDAF-6EB4C9B3	HIGH	Unencrypted Database Connection Interception Attacker who has gained a foothold within the Private App Zone (e.g. via a...	Ransomware Operator medium	API Gateway → Product Microservice → Product Database	3.11	3	60%
Business impact: Mass PII/payment data exfiltration; PCI DSS breach; regulatory fines and customer notification Attack hops API Gateway [api-gateway] (entry) Protocol: https · no auth · hop score: 2.92 Techniques: T1566 — Phishing  \|  T1078 — Valid Accounts  \|  T1078.001 — Default Accounts Product Microservice [default] (intermediate) Protocol: https · no auth · hop score: 3.57 Techniques: T1021 — Remote Services  \|  T1566 — Phishing  \|  T1021.001 — Remote Desktop Protocol Product Database [database] (target) Protocol: tcp · cleartext · no auth · hop score: 2.84 Techniques: T1486 — Data Encrypted for Impact  \|  T1490 — Inhibit System Recovery  \|  T1078 — Valid Accounts
4 GDAF-77FCFE51	HIGH	CI/CD Server Pivot to Production Microservice Attacker compromises the CI/CD server (via RCE, credential theft, or supply...	Rogue DevOps Engineer (Insider Threat) high	CI/CD Server → Product Microservice	3.8 🥊	2	35%
Business impact: Persistent backdoor in production; all customer data processed by the compromised service at risk Attack hops CI/CD Server [management-server] (entry) Protocol: ssh · no auth · hop score: 4.23 Techniques: T1078 — Valid Accounts  \|  T1021.001 — Remote Desktop Protocol  \|  T1570 — Lateral Tool Transfer Product Microservice [default] (target) Protocol: ssh · no auth · hop score: 3.37 Techniques: T1078 — Valid Accounts  \|  T1195 — Supply Chain Compromise  \|  T1659 — Content Injection
5 GDAF-D6767346	CRITICAL	CI/CD Server Pivot to Production Microservice Attacker compromises the CI/CD server (via RCE, credential theft, or supply...	Rogue DevOps Engineer (Insider Threat) high	CI/CD Server	4.23 🥊	1	20%
Business impact: Persistent backdoor in production; all customer data processed by the compromised service at risk Attack hops CI/CD Server [management-server] (entry) Protocol: ssh · no auth · hop score: 4.23 Techniques: T1078 — Valid Accounts  \|  T1021.001 — Remote Desktop Protocol  \|  T1570 — Lateral Tool Transfer
6 GDAF-53EFDA43	HIGH	CI/CD Server Pivot to Production Microservice Attacker compromises the CI/CD server (via RCE, credential theft, or supply...	Ransomware Operator medium	API Gateway → Product Microservice	3.15 🥊	2	65%
Business impact: Persistent backdoor in production; all customer data processed by the compromised service at risk Attack hops API Gateway [api-gateway] (entry) Protocol: https · no auth · hop score: 2.92 Techniques: T1566 — Phishing  \|  T1078 — Valid Accounts  \|  T1078.001 — Default Accounts Product Microservice [default] (target) Protocol: https · no auth · hop score: 3.37 Techniques: T1021 — Remote Services  \|  T1566 — Phishing  \|  T1659 — Content Injection
7 GDAF-DD31E3BB	HIGH	API Gateway Bypass to Direct Microservice Access Attacker discovers that the Product Microservice is reachable directly...	External Attacker (Credential Stuffing + OWASP Exploitation) medium	API Gateway → Product Microservice	3.06	2	65%
Business impact: Unrestricted access to business logic and data endpoints; DoS and data scraping Attack hops API Gateway [api-gateway] (entry) Protocol: https · no auth · hop score: 3.0 Techniques: T1190 — Exploit Public-Facing Application  \|  T1059 — Command and Scripting Interpreter  \|  T1078 — Valid Accounts Product Microservice [default] (target) Protocol: https · no auth · hop score: 3.13 Techniques: T1190 — Exploit Public-Facing Application  \|  T1659 — Content Injection  \|  T1059 — Command and Scripting Interpreter

🔍 Automatically Discovered Attack Paths 3 Found from the threat data itself, no GDAF context needed — click to expand

Unlike GDAF (analyst-defined objectives and actors), these paths are found automatically by following each threat's MITRE ATT&CK tactic progression through the architecture. Best (highest-severity) path shown per STRIDE category.

#	STRIDE Category	Attack Path	Score	Hops	Threats
1	Elevation of Privilege	CDN Load Balancer → CDN Load Balancer → API Gateway → DevOps Engineer → API Gateway → ProductSvcToDB → ProductSvcToDB → CI/CD Server → DevOpsToCICD → CICDToProductSvc → Product Microservice → Product Database	79.4	CDN Load Balancer T1195 — Supply Chain Compromise (Initial Access) CDN Load Balancer T1072 — Software Deployment Tools (Execution) API Gateway T1553 — Subvert Trust Controls (Defense Evasion) DevOps Engineer T1082 — System Information Discovery (Discovery) API Gateway T1072 — Software Deployment Tools (Execution) ProductSvcToDB T1005 — Data from Local System (Collection) ProductSvcToDB T1052 — Exfiltration Over Physical Medium (Exfiltration) CI/CD Server → DevOpsToCICD → CICDToProductSvc → Product Microservice → Product Database T1498 — Network Denial of Service (Impact)	T-0003, T-0003, T-0005, T-0002, T-0004, T-0007, T-0007, T-0073
	Narrative: An attacker begins by compromising the CDN Load Balancer through a supply chain compromise or unpatched software vulnerability, gaining initial access. Using software deployment tools, they execute code on the load balancer and pivot to the API Gateway, where they subvert trust controls via an event injection vulnerability to achieve arbitrary code execution. The attacker then discovers system information through the DevOps Engineer's SSH session and leverages software deployment tools again through the API Gateway to move deeper. Credentials and data are collected from the local system as they travel across the unencrypted channel from the Product Microservice to the Product Database, and exfiltrated over the physical medium. Finally, the attacker exploits the SSH dataflows between the CI/CD server and the Product Microservice to inject malicious code or backdoors, leveraging trusted access for impact. Business impact: Successful exploitation leads to full compromise of the Product Database and microservice, enabling data exfiltration, injection of malicious code or backdoors via the CI/CD pipeline, and potential lateral movement into broader infrastructure, resulting in significant reputational damage, regulatory fines, and operational disruption.
2	Information Disclosure	CDN Load Balancer → CDN Load Balancer → API Gateway → DevOps Engineer → API Gateway → ProductSvcToDB → ProductSvcToDB → CI/CD Server → DevOpsToCICD → CICDToProductSvc → Product Microservice → Product Database	79.4	CDN Load Balancer T1195 — Supply Chain Compromise (Initial Access) CDN Load Balancer T1072 — Software Deployment Tools (Execution) API Gateway T1553 — Subvert Trust Controls (Defense Evasion) DevOps Engineer T1082 — System Information Discovery (Discovery) API Gateway T1072 — Software Deployment Tools (Execution) ProductSvcToDB T1005 — Data from Local System (Collection) ProductSvcToDB T1052 — Exfiltration Over Physical Medium (Exfiltration) CI/CD Server → DevOpsToCICD → CICDToProductSvc → Product Microservice → Product Database T1498 — Network Denial of Service (Impact)	T-0003, T-0003, T-0005, T-0002, T-0004, T-0007, T-0007, T-0073
	Narrative: An attacker begins by compromising the CDN Load Balancer through a supply chain compromise or unpatched software vulnerability, gaining initial access. Using software deployment tools for execution, the attacker pivots to the API Gateway, where they subvert trust controls via an event injection vulnerability to achieve arbitrary code execution. With engineer credentials obtained through SSH key theft, the attacker navigates to the CI/CD server, then leverages trusted SSH dataflows to inject malicious code into the product microservice. Finally, exploiting unencrypted credential transmission, the attacker queries the product database and exfiltrates data over the physical medium. Business impact: Successful exploitation leads to full compromise of the product microservice and database, resulting in unauthorized data exfiltration, potential injection of malicious code or backdoors via the CI/CD pipeline, and significant reputational and financial damage from the breach of sensitive product information.
3	Tampering	CDN Load Balancer → CDN Load Balancer → API Gateway → DevOps Engineer → API Gateway → ProductSvcToDB → ProductSvcToDB → CI/CD Server → DevOpsToCICD → CICDToProductSvc → Product Microservice → Product Database	79.4	CDN Load Balancer T1195 — Supply Chain Compromise (Initial Access) CDN Load Balancer T1072 — Software Deployment Tools (Execution) API Gateway T1553 — Subvert Trust Controls (Defense Evasion) DevOps Engineer T1082 — System Information Discovery (Discovery) API Gateway T1072 — Software Deployment Tools (Execution) ProductSvcToDB T1005 — Data from Local System (Collection) ProductSvcToDB T1052 — Exfiltration Over Physical Medium (Exfiltration) CI/CD Server → DevOpsToCICD → CICDToProductSvc → Product Microservice → Product Database T1498 — Network Denial of Service (Impact)	T-0003, T-0003, T-0005, T-0002, T-0004, T-0007, T-0007, T-0073
	Narrative: An attacker begins by compromising the CDN Load Balancer through a supply chain compromise or unpatched software vulnerability, gaining initial access. Using software deployment tools, they execute code on the load balancer and pivot to the API Gateway, where they subvert trust controls via an event injection vulnerability to achieve arbitrary code execution. The attacker then discovers system information through the DevOps Engineer's SSH session, leveraging weak two-factor authentication and IP filtering protections. From the API Gateway, they exploit unpatched software vulnerabilities to move laterally, exfiltrating credentials sent over unencrypted channels from the Product Microservice to the Product Database. Finally, the attacker leverages SSH access through the CI/CD pipeline to inject malicious code or backdoors, ultimately compromising the Product Database. Business impact: Successful exploitation leads to full compromise of the Product Database, enabling data exfiltration, persistent backdoors, and potential disruption of product availability. The attacker can inject malicious code via the CI/CD pipeline, risking supply chain contamination that affects all downstream deployments and erodes customer trust in the product's integrity and security.

🥊 Adversarial Review 5 Red (attack) vs. Blue (defence) challenge on top attack paths — click to expand

Each top attack path below was challenged in a multi-round Red (attack) vs. Blue (defence) exchange. Read it for what Blue blocked, where detection gaps remain, and what Red tried and failed. The verdict is a qualitative outcome — the numeric score adjustment it drives is directional, not precise (see docs/evaluation.md).

RESIDUAL PATH VIABLE ⚡ GDAF-D6767346 CI/CD Server Pivot to Production Microservice DevOps Engineer → CI/CD Server

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked

T1078
T1078

🕳️ Detection gaps on the residual path

Step	Control family	Covered	Detail	Confidence
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium

2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)

📜 Full debate transcript

Round 1 · RED · viability estimate 0.75

Leverage SSH access via credential stuffing (T1078) combined with malicious artifact deployment (T1570) to pivot from the DevOps engineer session to the CI/CD server.

SSH endpoint accepts password authentication for DevOps engineer account — misconfig: protocol=ssh, is_authenticated=false, entry point: DevOps Engineer (high)
T1570.001 — File System Staging: can write to CI/CD server staging directories — technique: CI/CD Server [entry] known CVEs: CVE-2023-27898, CVE-2024-23897 (high)

Round 1 · BLUE · viability estimate 0.50

T1078 blocked by EDR credential reuse detection; T1570 deployment still viable via SSH session

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

Round 2 · RED · viability estimate 0.50

SSH session established via T1021.001; credential reuse via T1078 detected and blocked by Blue's EDR, but T1021.001 remains viable for lateral movement

SSH endpoint accepts password auth — misconfig: hop 2 dataflow: protocol=ssh, is_authenticated=false (high)

Round 2 · BLUE · viability estimate 0.50

EDR blocks T1078 credential reuse; T1021.001 SSH lateral movement remains viable due to missing SIEM correlation for external password-auth SSH.

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

RESIDUAL PATH VIABLE ⚡ GDAF-74EA3363 Unencrypted Database Connection Interception DevOps Engineer → Product Database

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked

T1078
T1078

🕳️ Detection gaps on the residual path

Step	Control family	Covered	Detail	Confidence
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium
T1195 event log clearance on CI/CD server	SIEM	❌	No SIEM correlation rule for T1195 audit log clearance events on CI/CD server	medium

🚫 Red's failed alternative attempts

Attempted T1078 — blocked at EDR via credential reuse pattern detection

2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)

📜 Full debate transcript

Round 1 · RED · viability estimate 0.75

Leverage the DevOps Engineer's SSH access to the CI/CD server and Product Microservice to pivot to the Product Database. The database protocol is unauthenticated and unencrypted (tcp, protocol=tcp, unauthenticated, unencrypted), allowing credential exfiltration or data tampering via T1030. Credentials harvested from the CI/CD server or microservice can be used to authenticate to the database.

Product Database is unauthenticated and unencrypted — misconfig: Product Database [target]: protocol=tcp, unauthenticated, unencrypted (high)
SSH access available from DevOps Engineer entry point — protocol: CI/CD Server [entry]: protocol=ssh, unauthenticated (high)

Round 1 · BLUE · viability estimate 0.50

T1078 is blocked at the EDR level via credential reuse pattern detection; T1030 remains viable due to unauthenticated database protocol allowing credential exfiltration or data tampering without network-level controls.

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

Round 2 · RED · viability estimate 0.50

T1195 (Event Log Clearance) can disable Blue's audit logging for T1030, and T1030 leverages the unauthenticated, unencrypted database protocol to intercept data in transit. T1030 is currently viable as Blue has no network-level controls on the database protocol.

Database protocol is unauthenticated and unencrypted — misconfig: Product Database [target] dataflow: protocol=tcp, unauthenticated, unencrypted (high)
T1195 can clear event logs to hide T1030 activity — technique: Product Microservice [intermediate] dataflow: protocol=ssh, candidate techniques: T1195 (high)

Round 2 · BLUE · viability estimate 0.50

T1078 blocked via EDR credential reuse detection; T1030 remains viable due to lack of network controls on the database protocol; T1195 detection gap exists because no SIEM rule correlates event log clearance events on the CI/CD server.

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

RESIDUAL PATH VIABLE ⚡ GDAF-77FCFE51 CI/CD Server Pivot to Production Microservice DevOps Engineer → Product Microservice

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked

T1078
T1078

🕳️ Detection gaps on the residual path

Step	Control family	Covered	Detail	Confidence
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium

🚫 Red's failed alternative attempts

Attempted T1110 password spraying — blocked by account lockout policy

2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)

📜 Full debate transcript

Round 1 · RED · viability estimate 0.75

Leveraging CI/CD server SSH access via T1078 (valid accounts) and T1570 (lateral tool transfer) to pivot to the Product Microservice, which also exposes an unauthenticated SSH endpoint.

CI/CD Server SSH endpoint accepts unauthenticated connections — protocol_data: CI/CD Server [entry]: protocol=ssh, unauthenticated=true (high)
Product Microservice SSH endpoint accepts unauthenticated connections — protocol_data: Product Microservice [target]: protocol=ssh, unauthenticated=true (high)

Round 1 · BLUE · viability estimate 0.50

T1078 blocked at credential reuse boundary; T1570 lateral transfer remains viable via unauthenticated SSH to Product Microservice

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

Round 2 · RED · viability estimate 0.50

T1078 blocked at credential reuse boundary per Blue's response; T1195 (Supply Chain) attempted via CI/CD artifact injection but blocked by artifact integrity verification. Pivot to Product Microservice via unauthenticated SSH remains viable.

SSH endpoint accepts password auth — misconfig: hop 2 dataflow: protocol=ssh, is_authenticated=false (high)

Round 2 · BLUE · viability estimate 0.50

T1078 blocked at credential reuse boundary; T1195 blocked by artifact integrity verification. Unauthenticated SSH to Product Microservice remains undetected by SIEM rules.

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

RESIDUAL PATH VIABLE ⚡ GDAF-B2B36365 Authentication Bypass via OIDC Misconfiguration End User → Auth Service

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked

T1078
T1078

🕳️ Detection gaps on the residual path

Step	Control family	Covered	Detail	Confidence
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium

🚫 Red's failed alternative attempts

Attempted T1110 password spraying — blocked by account lockout policy

2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)

📜 Full debate transcript

Round 1 · RED · viability estimate 0.75

Leveraging API Gateway unauthenticated access to probe Auth Service OIDC endpoint with crafted requests (T1190) and HTTP Tunneling (T1078) to bypass authentication checks.

API Gateway allows unauthenticated HTTPS traffic — protocol: API Gateway [entry]: protocol=https, unauthenticated (high)
Auth Service OIDC endpoint may accept malformed requests without validation — misconfig: Auth Service [target]: protocol=https, candidate techniques: T1110, T1212, T1528 (medium)

Round 1 · BLUE · viability estimate 0.50

T1190 is not blocked because the API Gateway is unauthenticated and encrypted, allowing the OIDC probe; T1078 is blocked by EDR credential reuse detection on the auth host.

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

Round 2 · RED · viability estimate 0.75

T1190 (OIDC probe) leverages the unauthenticated, encrypted API Gateway to interact with the Auth Service. T1078 is attempted via the SSH endpoint that accepts password auth, but EDR blocks credential reuse. The combined approach maintains partial viability.

API Gateway allows unauthenticated OIDC probe over HTTPS — protocol_behavior: API Gateway [entry]: protocol=https, unauthenticated, encrypted, candidate techniques: T1190 (high)
SSH endpoint accepts password-based authentication — misconfig: hop 2 dataflow: protocol=ssh, is_authenticated=false (high)

Round 2 · BLUE · viability estimate 0.50

T1190 is allowed through the unauthenticated API Gateway, but T1078 is blocked at the EDR layer due to credential reuse detection, leaving partial attack viability.

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

RESIDUAL PATH VIABLE ⚡ GDAF-53EFDA43 CI/CD Server Pivot to Production Microservice End User → Product Microservice

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 1 technique(s); 1 detection gap(s) remain.

✅ Paths Blue successfully blocked

T1078

🕳️ Detection gaps on the residual path

Step	Control family	Covered	Detail	Confidence
hop 2 SSH access	SIEM	❌	No correlation rule for password-auth SSH from external IP ranges	medium

1 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)

📜 Full debate transcript

Round 1 · RED · viability estimate 0.75

Leverage API Gateway unauthenticated access to deliver a malicious payload via T1078 (valid accounts) and T1566 (phishing-like social engineering), then pivot to the Product Microservice using the known CVE-2023-30581 exploit for remote code execution.

API Gateway allows unauthenticated HTTPS requests — protocol_config: API Gateway [entry]: protocol=https, unauthenticated (high)
Product Microservice has known CVE-2023-30581 — cve: Product Microservice [target]: known CVEs: CVE-2023-30581 (high)

Round 1 · BLUE · viability estimate 0.50

T1078 blocked at the credential validation layer; T1566 social engineering payload delivery cannot be blocked at the gateway due to unauthenticated encrypted traffic, but EDR credential reuse detection provides partial mitigation.

EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)

📖 Severity Calculation Explained▶

Threat severity is calculated on a scale of 1.0 to 10.0 using the following factors: 1. **Base Score**: Each STRIDE threat category has a predefined base score (ElevationOfPrivilege: 9.0, Tampering: 8.0, InformationDisclosure: 7.5, Spoofing: 7.0, DenialOfService: 6.0, Repudiation: 5.0). 2. **Impact and Likelihood**: If provided (scale 1–5), their product is normalised and added. 3. **Target Multipliers**: Per-element multipliers from the '## Severity Multipliers' section of the model. 4. **Protocol Adjustments**: SSH +0.5, HTTPS -0.3, HTTP +0.2. 5. **Data Classification**: PUBLIC ×1.0, RESTRICTED ×1.2, SECRET ×1.5, TOP_SECRET ×2.0 multiplier. 6. **VOC Context (when available)**: - Known CVE match for this target: +0.5 - High-risk CWE class (injection, buffer overflow, hardcoded creds…): +0.3 - Network-exposed without authentication or encryption: +0.7 - Active D3FEND defensive controls in place: -0.5 The final score is clamped to [1.0, 10.0] and mapped to INFORMATIONAL / LOW / MEDIUM / HIGH / CRITICAL.

Legend:
* : Indicates a CAPEC or MITRE mapping was manually added to improve relevance.
: Indicates a mitigation has been implemented (as defined in the implemented mitigations file).

🔍 Detailed Threat Analysis

Filter by Target:

Filter by Source:

Filter by Business Value:

Filter by Severity:

Hide accepted / FP

#	Target	Business Value	Source	Description	Conf.	Severity	Risk Signals	CAPEC	MITRE Techniques	MITRE Mitigations	D3FEND Mitigations	CIS Mitigations	NIST Mitigations	OWASP Mitigations	Detection (SOC)
1	Product Database	N/A	pytm	Denial of Service against Product Database through resource-intensive queries or excessive connections TK-86389529	1.00	HIGH (8.9)	D3F	CAPEC-488: HTTP Flood CAPEC-115: Authentication Bypass	T1499: Endpoint Denial of Service T1548: Abuse Elevation Control Mechanism	M1037: Filter Network Traffic M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-NI: Network Isolation D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SU: Software Update Replacing old software on a computer system component. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 7.7: Remediate Detected Vulnerabilities CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Access Enforcement Information Flow Enforcement Continuous Monitoring Configuration Settings Least Functionality Boundary Protection Information Input Validation Information Output Filtering System Monitoring Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V13.2.1: Resource Limiting OWASP ASVS V1.4.1: Access Control Design	—
2	API Gateway	N/A	pytm	Improper rate limiting on API Gateway API Gateway, leading to Denial of Service. TK-594625FE	1.00	HIGH (8.4)	NET D3F	CAPEC-601: Jamming * CAPEC-301: TCP Connect Scan *	T1499: Endpoint Denial of Service *	M1037: Filter Network Traffic	D3-NI: Network Isolation	CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 7.7: Remediate Detected Vulnerabilities	Access Enforcement Information Flow Enforcement Continuous Monitoring Configuration Settings Least Functionality Boundary Protection Information Input Validation Information Output Filtering System Monitoring	OWASP ASVS V13.2.1: Resource Limiting	—
3	Product Database	N/A	AI	(AI) Database Service Exhaustion via Sustained Connection Flood: The Product Database is not protected by a WAF or IPS and relies on redundant infrastructure only. An attacker who discovers the database endpoint IP can send a high volume of connection requests, exhausting database connection pools and CPU resources, leading to availability degradation for the Product Microservice and downstream customers. TK-F64DC492	0.90	HIGH (8.9)	D3F	CAPEC-121: Exploit Non-Production Interfaces CAPEC-227: Sustained Client Engagement CAPEC-482: TCP Flood CAPEC-486: UDP Flood CAPEC-487: ICMP Flood CAPEC-488: HTTP Flood CAPEC-489: SSL Flood CAPEC-528: XML Flood	T1499: Endpoint Denial of Service T1498: Network Denial of Service	M1037: Filter Network Traffic M1037: Filter Network Traffic	D3-NI: Network Isolation	CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 7.7: Remediate Detected Vulnerabilities CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets	Access Enforcement Information Flow Enforcement Continuous Monitoring Configuration Settings Least Functionality Boundary Protection Information Input Validation Information Output Filtering System Monitoring Access Enforcement Information Flow Enforcement Continuous Monitoring Configuration Settings Least Functionality Boundary Protection Information Input Validation Information Output Filtering	OWASP ASVS V13.2.1: Resource Limiting	🔍 LOW Missing logs (4) Database firewall logs — connection attempts blocked or allowed by IP address Database connection pool metrics — active connections, wait times, error rates Network IDS/IPS logs — SYN flood detection and database endpoint scanning Cloud security group flow logs — inbound connection attempts to database endpoint SIEM rules (3) Database endpoint connection flood — high volume of new connections `event_type=db_connection_attempt AND dest_port=5432 AND count > 50 within 1m grouped by src_ip` Database connection pool exhaustion — max connections reached `event_type=db_connection_error AND error_code=too_many_connections OR wait_count > 80` Outbound DNS queries from database host to unknown domains `event_type=dns_query AND src_ip=db_host_ip AND dest_domain not in approved_domains` IOCs (3) Database server IP addresses and port numbers discovered through reconnaissance Known database exploit tool signatures (e.g., 'sqlmap', 'nmap' database scan scripts) Connection flood patterns: SYN packets without completion, rapid connection open/close cycles
4	API Gateway	N/A	AI	(AI) API Gateway Request Volume Exhaustion: The API Gateway has redundant controls but lacks rate limiting or request size restrictions. An attacker can send a high volume of requests, exhausting gateway connection pools or thread pools, leading to denial of service for legitimate customers. TK-E37F16E0	0.90	HIGH (7.6)	NET D3F	CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-655: Avoid Security Tool Identification by Adding Data	T1027: Obfuscated Files or Information	M1047: Audit M1040: Behavior Prevention on Endpoint M1017: User Training M1049: Antivirus/Antimalware	D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.	CIS 10.1: Deploy and Maintain Anti-Malware Software CIS 10.2: Configure Automatic Anti-Malware Signature Updates CIS 10.7: Use Behavior-Based Anti-Malware Software CIS 13.2: Deploy a Host-Based Intrusion Detection Solution CIS 13.7: Deploy a Host-Based Intrusion Prevention Solution	Baseline Configuration Configuration Settings Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	🔍 MEDIUM Missing logs (3) API Gateway rate limiting metrics — requests per second per IP, per endpoint, per user agent API Gateway connection pool utilization metrics WAF logs — request rate anomalies and layer 7 DDoS signatures SIEM rules (3) API Gateway connection pool exhaustion — sustained high request volume `event_type=api_gateway_request AND (response_status=503 OR response_status=504) AND count > 100 within 1m` API Gateway thread pool saturation — high concurrency from single source `event_type=api_gateway_request AND concurrency_metrics > 90th_percentile grouped by src_ip within 5m` API Gateway request size anomalies — abnormally large payloads `event_type=api_gateway_request AND request_body_size > 1048576 grouped by src_ip` IOCs (3) Botnet IP ranges and known DDoS source addresses HTTP request headers indicating automation (e.g., 'X-RateLimit-Limit: 0', missing expected headers) Payloads containing resource-exhaustive patterns (e.g., large nested JSON, repeated regex quantifiers)
5	secure data zone	N/A	AI	(AI) Lack of Redundancy and DoS Vulnerability: The Secure Data Zone is marked as 'Redundant: No'. As a critical trust boundary with no specified DDoS protections (WAF/IDS/IPS absent), an attacker could flood the segment with traffic, causing unavailability of services relying on this zone. The lack of redundancy means there is no failover capacity. TK-5773B6BB	0.90	HIGH (7.6)	NET D3F	CAPEC-111: JSON Hijacking (aka JavaScript Hijacking) CAPEC-112: Brute Force	T1110: Brute Force	M1018: User Account Management M1036: Account Use Policies M1032: Multi-factor Authentication M1027: Password Policies	D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-AL: Account Locking The process of temporarily disabling user accounts on a system or domain. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 6.3: Require MFA for Externally-Exposed Applications CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access	Account Management Use of External Systems Access Enforcement Separation of Duties Least Privilege Unsuccessful Logon Attempts Continuous Monitoring Baseline Configuration Configuration Settings Re-authentication Identification and Authentication (organizational Users) Identifier Management Authenticator Management System Monitoring	OWASP ASVS V2.2.1: Account Lockout Mechanism OWASP ASVS V2.2.2: Automated Threat Detection	🔍 MEDIUM Missing logs (3) WAF logs — rate limiting and anomaly scores per source IP IDS/IPS alerts — volumetric traffic detection and known attack signatures Cloud provider DDoS protection metrics — attack detection and mitigation events SIEM rules (3) Volumetric traffic anomaly to data zone `count(srcIP) > 5000 within 60s AND dstZone=secure_data AND protocol IN (tcp,udp) AND rate > 1000pps` Unusual protocol mix in data zone `entropy(protocol) > 0.8 AND dstZone=secure_data AND duration > 300s` Failed DDoS mitigation bypass `eventName=DDoSAttackDetected AND mitigationStatus=failed AND time > 24h` IOCs (3) Botnet C2 domain patterns: .botnet.com, *.pwned.io Known DDoS tool signatures: slowloris, hulk, slowhttptest HTTP request patterns IP ranges associated with cloud stress-testing services

#	Target	Business Value	Source	Description	Conf.	Severity	Risk Signals	CAPEC	MITRE Techniques	MITRE Mitigations	D3FEND Mitigations	CIS Mitigations	NIST Mitigations	OWASP Mitigations	Detection (SOC)
1	DevOps Engineer	N/A	AI	(AI) SSH Key Theft and Lateral Movement to CI/CD Server: The DevOps Engineer's SSH session to the CI/CD server is protected only by two-factor authentication and IP filtering. If the engineer's local machine or SSH keys are compromised, the attacker gains direct trusted access to the CI/CD infrastructure, bypassing network-level controls. TK-90110DA8	0.90	CRITICAL (10.0)	NET ⛔D3F	CAPEC-312: Active OS Fingerprinting CAPEC-318: IP 'ID' Echoed Byte-Order Probe	T1082: System Information Discovery	No specific MITRE mitigations found.	No specific D3FEND mitigations found.	No specific CIS mitigations found.	No specific NIST mitigations found.	No specific OWASP mitigations found.	🔍 HIGH Missing logs (4) Sysmon Event 1 — process creation on DevOps workstation with command line arguments Sysmon Event 7 — network connection events from DevOps workstation to CI/CD server Cloud SSO sign-in logs — sign-in risk events and conditional access policies triggered EDR telemetry — SSH key material extraction or credential dumping on endpoint SIEM rules (3) SSH private key material accessed or exported from DevOps workstation `process_endswith('.pem') OR process_endswith('.key') OR process_endswith('.ppk') AND (event_type=file_create OR event_type=file_open) AND NOT process_name=ssh-agent` SSH connection to CI/CD server from unexpected source or without prior session `event_type=network_connection AND dest_port=22 AND dest_ip=ci_cd_server_ip AND (src_ip not in approved_devops_subnet OR src_user not in approved_users)` CI/CD server executed commands referencing SSH keys or deployment credentials `event_type=process_creation AND (command_line contains 'ssh-add' OR command_line contains 'ssh-keyscan' OR command_line contains 'DEPLOY_KEY')` IOCs (3) SSH private keys in PEM format found in non-standard locations on workstation Process names mimicking legitimate SSH tools but with anomalous command lines (e.g., 'ssh -O forward', 'nc -zv') Base64-encoded SSH key material in process command lines or environment variables
2	Auth Service	N/A	pytm	Unauthorized privilege escalation on Auth Service due to misconfiguration or vulnerability TK-22B69D9A	1.00	CRITICAL (10.0)	D3F	CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-233: Privilege Escalation	T1574: Hijack Execution Flow T1548: Abuse Elevation Control Mechanism	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
3	Auth Service	N/A	pytm	Container escape vulnerability on Auth Service, allowing an attacker to gain access to the underlying host. TK-3F6D485C	1.00	CRITICAL (10.0)	D3F	CAPEC-585: DNS Domain Seizure *	T1611: Escape to Host *	M1051: Update Software M1038: Execution Prevention M1048: Application Isolation and Sandboxing M1026: Privileged Account Management M1042: Disable or Remove Feature or Program	D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DA: Dynamic Analysis Executing or opening a file in a synthetic "sandbox" environment to determine if the file is a malicious program or if the file exploits another program such as a document reader. D3-HBPI: Hardware-based Process Isolation Preventing one process from writing to the memory space of another process through hardware based address manager implementations. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface.	No specific CIS mitigations found.	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Separation of System and User Functionality Security Function Isolation Non-modifiable Executable Programs Process Isolation Boundary Protection Memory Protection Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
4	Product Microservice	N/A	pytm	Unauthorized privilege escalation on Product Microservice due to misconfiguration or vulnerability TK-96B04960	1.00	CRITICAL (10.0)	D3F	CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-233: Privilege Escalation	T1574: Hijack Execution Flow T1548: Abuse Elevation Control Mechanism	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
5	Product Database	N/A	pytm	Unauthorized privilege escalation on Product Database due to misconfiguration or vulnerability TK-66671956	1.00	CRITICAL (10.0)	D3F	CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-233: Privilege Escalation	T1574: Hijack Execution Flow T1548: Abuse Elevation Control Mechanism	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
6	CI/CD Server	N/A	pytm	Unauthorized privilege escalation on CI/CD Server due to misconfiguration or vulnerability TK-C3BC4215	1.00	CRITICAL (10.0)	D3F	CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-233: Privilege Escalation	T1574: Hijack Execution Flow T1548: Abuse Elevation Control Mechanism	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
7	CDN Load Balancer	N/A	pytm	Unauthorized privilege escalation on CDN Load Balancer due to misconfiguration or vulnerability TK-8561732B	1.00	CRITICAL (9.2)	NET D3F	CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-233: Privilege Escalation	T1574: Hijack Execution Flow T1548: Abuse Elevation Control Mechanism	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
8	API Gateway	N/A	pytm	Unauthorized privilege escalation on API Gateway due to misconfiguration or vulnerability TK-896D4979	1.00	CRITICAL (9.2)	NET D3F	CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-233: Privilege Escalation	T1574: Hijack Execution Flow T1548: Abuse Elevation Control Mechanism	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
9	CI/CD Server	N/A	pytm	Lateral movement from management server CI/CD Server to other systems in the network for further compromise. TK-7AF48312	1.00	CRITICAL (9.4)	D3F	CAPEC-555: Remote Services with Stolen Credentials * CAPEC-645: Use of Captured Tickets (Pass The Ticket) *	T1021: Remote Services * T1550.002: Pass the Hash *	M1035: Limit Access to Resource Over Network M1047: Audit M1018: User Account Management M1042: Disable or Remove Feature or Program M1032: Multi-factor Authentication M1027: Password Policies M1051: Update Software M1052: User Account Control M1018: User Account Management M1026: Privileged Account Management	D3-NI: Network Isolation D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-SU: Software Update Replacing old software on a computer system component.	CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Remote Access Account Management Use of External Systems Access Enforcement Separation of Duties Least Privilege Unsuccessful Logon Attempts Access Restrictions for Change Configuration Settings Identification and Authentication (organizational Users) Authenticator Management System Monitoring Account Management Access Enforcement Separation of Duties Least Privilege Access Restrictions for Change Configuration Settings Identification and Authentication (organizational Users) Flaw Remediation	No specific OWASP mitigations found.	—
10	Product Microservice	N/A	pytm	Container escape vulnerability on Product Microservice, allowing an attacker to gain access to the underlying host. TK-B7D650BC	1.00	CRITICAL (9.3)	D3F	CAPEC-585: DNS Domain Seizure *	T1611: Escape to Host *	M1051: Update Software M1038: Execution Prevention M1048: Application Isolation and Sandboxing M1026: Privileged Account Management M1042: Disable or Remove Feature or Program	D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DA: Dynamic Analysis Executing or opening a file in a synthetic "sandbox" environment to determine if the file is a malicious program or if the file exploits another program such as a document reader. D3-HBPI: Hardware-based Process Isolation Preventing one process from writing to the memory space of another process through hardware based address manager implementations. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface.	No specific CIS mitigations found.	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Separation of System and User Functionality Security Function Isolation Non-modifiable Executable Programs Process Isolation Boundary Protection Memory Protection Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
11	Product Database → ProductSvcToDB → Product Microservice → Auth Service	N/A	LLM	(RAG-LLM) PostgreSQL Database Pivot via Known Vulnerability: The attacker exploits the known PostgreSQL vulnerability in versions older than 14.x to gain remote code execution on the Product Database server. From this foothold, the attacker pivots laterally through the ProductSvcToDB dataflow trust boundary to compromise the Product Microservice, and subsequently the Auth Service, leveraging the database's elevated privileges to access sensitive customer data and payment processing functions. TK-230BF615	0.90	CRITICAL (10.0)	⛔D3F	CAPEC-516: Hardware Component Substitution During Baselining	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
12	CI/CD Server → DevOpsToCICD → API Gateway → Auth Service → Product Microservice	N/A	LLM	(RAG-LLM) Credential Harvesting via Compromised CI/CD Pipeline: An attacker compromises the CI/CD server through a phishing attack or supply chain vulnerability, then injects malicious code into the deployment pipeline. When the DevOps engineer triggers deployment to the Kubernetes cluster, the malicious code exfiltrates AWS credentials stored in environment variables or secret management to an external endpoint. The attacker subsequently uses these credentials to pivot into the Kubernetes API server, gaining unauthorized access to all microservices including the Auth Service and Product Microservice. TK-006E76DE	0.85	CRITICAL (10.0)	⛔D3F	CAPEC-501: Android Activity Hijack CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-196: Session Credential Falsification through Forging CAPEC-226: Session Credential Falsification through Manipulation CAPEC-59: Session Credential Falsification through Prediction CAPEC-101: Server Side Include (SSI) Injection CAPEC-108: Command Line Execution through SQL Injection CAPEC-110: SQL Injection through SOAP Parameter Tampering CAPEC-13: Subverting Environment Variable Values CAPEC-16: Dictionary-based Password Attack CAPEC-17: Using Malicious Files CAPEC-175: Code Inclusion	T1606: Forge Web Credentials T1562: Impair Defenses T1574: Hijack Execution Flow T1557: Adversary-in-the-Middle *	M1026: Privileged Account Management M1054: Software Configuration M1047: Audit M1018: User Account Management M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1037: Filter Network Traffic M1041: Encrypt Sensitive Information M1035: Limit Access to Resource Over Network M1042: Disable or Remove Feature or Program M1017: User Training M1031: Network Intrusion Prevention M1030: Network Segmentation	D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-SU: Software Update Replacing old software on a computer system component. D3-NI: Network Isolation D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-NTA: Network Traffic Analysis D3-OTF: Outbound Traffic Filtering Restricting network traffic originating from a private host or enclave destined towards untrusted networks. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume.	CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.1: Establish and Maintain a Data Management Process CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.6: Securely Manage Enterprise Assets and Software CIS 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 7.7: Remediate Detected Vulnerabilities CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 13.3: Deploy a Network Intrusion Detection Solution CIS 13.4: Perform Traffic Filtering Between Network Segments CIS 13.8: Deploy a Network Intrusion Prevention Solution CIS 14.2: Train Workforce Members to Recognize Social Engineering Attacks CIS 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 18.2: Perform Periodic External Penetration Tests CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Separation of Duties Least Privilege Public Key Infrastructure Certificates Flaw Remediation Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Use of External Systems Access Enforcement Information Flow Enforcement Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality System Component Inventory Vulnerability Monitoring and Scanning Session Authenticity Information in Shared System Resources Cross Domain Policy Enforcement Boundary Protection Transmission Confidentiality and Integrity Information Input Validation Information Management and Retention Information Output Filtering Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Immutable and Protected Logs OWASP ASVS V9.1: Strong TLS Configuration	—
13	Product Microservice	N/A	AI	(AI) CI/CD Credential Theft Enables Container Escape and Cluster Compromise: The CI/CD Server communicates with the Product Microservice over SSH using credentials. If an attacker obtains these credentials (via phishing, insider threat, or CI/CD pipeline compromise), they can authenticate to the microservice and potentially execute arbitrary commands or achieve container escape, pivoting into the broader Kubernetes cluster. TK-8DF99540	0.90	CRITICAL (9.3)	D3F	CAPEC-319: IP (DF) 'Don't Fragment Bit' Echoing Probe CAPEC-618: Cellular Broadcast Message Request CAPEC-555: Remote Services with Stolen Credentials CAPEC-561: Windows Admin Shares with Stolen Credentials CAPEC-101: Server Side Include (SSI) Injection CAPEC-17: Using Malicious Files CAPEC-177: Create files with the same name as files protected with a higher classification CAPEC-196: Session Credential Falsification through Forging CAPEC-199: XSS Using Alternate Syntax CAPEC-209: XSS Using MIME Type Mismatch CAPEC-226: Session Credential Falsification through Manipulation CAPEC-245: XSS Using Doubled Characters	T1021: Remote Services * T1557: Adversary-in-the-Middle * T1036: Masquerading T1606: Forge Web Credentials	M1035: Limit Access to Resource Over Network M1047: Audit M1018: User Account Management M1042: Disable or Remove Feature or Program M1032: Multi-factor Authentication M1027: Password Policies M1037: Filter Network Traffic M1041: Encrypt Sensitive Information M1035: Limit Access to Resource Over Network M1042: Disable or Remove Feature or Program M1017: User Training M1031: Network Intrusion Prevention M1030: Network Segmentation M1047: Audit M1018: User Account Management M1017: User Training M1045: Code Signing M1040: Behavior Prevention on Endpoint M1022: Restrict File and Directory Permissions M1049: Antivirus/Antimalware M1038: Execution Prevention M1026: Privileged Account Management M1054: Software Configuration M1047: Audit M1018: User Account Management	D3-NI: Network Isolation D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-NTA: Network Traffic Analysis D3-OTF: Outbound Traffic Filtering Restricting network traffic originating from a private host or enclave destined towards untrusted networks. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-SBV: Service Binary Verification Analyzing changes in service binary files by comparing to a source of truth. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections.	CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 3.1: Establish and Maintain a Data Management Process CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.6: Securely Manage Enterprise Assets and Software CIS 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 7.7: Remediate Detected Vulnerabilities CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 13.3: Deploy a Network Intrusion Detection Solution CIS 13.4: Perform Traffic Filtering Between Network Segments CIS 13.8: Deploy a Network Intrusion Prevention Solution CIS 14.2: Train Workforce Members to Recognize Social Engineering Attacks CIS 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 18.2: Perform Periodic External Penetration Tests CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 2.7: Allowlist Authorized Scripts CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Remote Access Account Management Use of External Systems Access Enforcement Separation of Duties Least Privilege Unsuccessful Logon Attempts Access Restrictions for Change Configuration Settings Identification and Authentication (organizational Users) Authenticator Management System Monitoring Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Use of External Systems Access Enforcement Information Flow Enforcement Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality System Component Inventory Vulnerability Monitoring and Scanning Session Authenticity Information in Shared System Resources Cross Domain Policy Enforcement Boundary Protection Transmission Confidentiality and Integrity Information Input Validation Information Management and Retention Information Output Filtering Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality Service Identification and Authentication Information Input Validation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Public Key Infrastructure Certificates Flaw Remediation	OWASP ASVS V9.1: Strong TLS Configuration	🔍 HIGH Missing logs (4) CI/CD server process execution logs — commands executed with SSH credentials CI/CD server file access logs — deployment scripts accessing credential files Container runtime audit logs — container start events and privileged escalation attempts Egress network flow logs — CI/CD server outbound connections to container registries or internal services SIEM rules (3) SSH credential usage on CI/CD server — deployment commands executed `event_type=process_creation AND (command_line contains 'ssh' OR command_line contains 'deploy') AND user=ci_cd_service_account` CI/CD server to container runtime API calls — container start/stop/restart `event_type=container_runtime_api AND (verb=POST OR verb=DELETE) AND target_container_runtime_api=/containers` Unusual CI/CD server outbound network connections `event_type=network_connection AND src_ip=ci_cd_server_ip AND dest_port not in (22, 80, 443) AND count > 5 within 10m` IOCs (3) SSH usernames and host patterns targeting CI/CD infrastructure (e.g., 'ci-user', 'deploy', 'jenkins') Known CI/CD compromise tool signatures (e.g., 'kubectl' used unexpectedly, 'docker' commands from CI host) Base64-encoded deployment secrets or Kubernetes service account tokens in process environments
14	End User	N/A	pytm	Privilege abuse by actor End User to gain unauthorized access or perform unauthorized actions TK-4CABE1C2	1.00	HIGH (7.6)	NET D3F	CAPEC-122: Privilege Abuse	T1548: Abuse Elevation Control Mechanism	M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SU: Software Update Replacing old software on a computer system component. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
15	DevOps Engineer	N/A	pytm	Privilege abuse by actor DevOps Engineer to gain unauthorized access or perform unauthorized actions TK-FCED2C02	1.00	HIGH (7.6)	NET D3F	CAPEC-122: Privilege Abuse	T1548: Abuse Elevation Control Mechanism	M1038: Execution Prevention M1028: Operating System Configuration M1051: Update Software M1052: User Account Control M1026: Privileged Account Management M1018: User Account Management M1047: Audit M1022: Restrict File and Directory Permissions	D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-SU: Software Update Replacing old software on a computer system component. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Mobile Code Non-modifiable Executable Programs Information Management and Retention Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V1.4.1: Access Control Design	—
16	public cloud zone	N/A	AI	(AI) Cloud IAM Role Escalation via Over-Permissive Cross-Account Permissions: The Public Cloud Zone trusts the cloud provider's network boundary. If IAM roles or policies across the e-commerce account and associated service accounts are over-permissive (e.g., star policies, unrestricted cross-account access), an attacker who compromises one service can escalate privileges to root or admin level across the cloud environment. TK-C8002733	0.90	HIGH (8.2)	NET D3F	CAPEC-524: Rogue Integration Procedures CAPEC-645: Use of Captured Tickets (Pass The Ticket) *	T1550.002: Pass the Hash *	M1051: Update Software M1052: User Account Control M1018: User Account Management M1026: Privileged Account Management	D3-SU: Software Update Replacing old software on a computer system component. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Separation of Duties Least Privilege Access Restrictions for Change Configuration Settings Identification and Authentication (organizational Users) Flaw Remediation	No specific OWASP mitigations found.	🔍 MEDIUM Missing logs (3) Cloud provider CloudTrail — AssumeRole and STS AssumeRoleWithSAML events Kubernetes audit logs — RBAC decisions and role bindings EDR process creation logs — unexpected parent-child chains involving aws-cli SIEM rules (3) Cross-account role assumption from compromised account `eventName=AssumeRole AND sourceIdentity.arn != targetIdentity.arn AND sourceIdentity.account != targetIdentity.account AND sessionDuration > 3600` STS GetFederationToken with elevated permissions `eventName=GetFederationToken AND (action:sts:AssumeRolePolicy OR policySize > 5000)` Unusual IAM policy changes in management account `eventName=AttachRolePolicy OR eventName=PutUserPolicy AND sourceIP NOT IN (known_cidrs)` IOCs (3) IAM role names containing: admin, root, poweruser Policy documents with Sid containing: FullAccess, Write, Delete AWS Access Key IDs originating from unexpected geographic regions
17	CI/CD Server → DevOpsToCICD → CICDToProductSvc → Product Microservice → Product Database	N/A	LLM	(RAG-LLM) Insider Threat Leveraging Trusted SSH Access: A malicious insider with DevOps privileges exploits the DevOpsToCICD and CICDToProductSvc SSH dataflows to inject malicious code or backdoors into the CI/CD pipeline. The insider leverages their legitimate access to escalate privileges across components, exfiltrating sensitive customer data from the Product Database through the CI/CD server's external connectivity, or disrupting the e-commerce platform during peak traffic periods. TK-3476F967	0.65	CRITICAL (9.4)	⛔D3F	CAPEC-468: Generic Cross-Browser Cross-Domain Theft CAPEC-666: BlueSmacking	T1498: Network Denial of Service T1499: Endpoint Denial of Service	M1037: Filter Network Traffic M1037: Filter Network Traffic	D3-NI: Network Isolation	CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 7.7: Remediate Detected Vulnerabilities	Access Enforcement Information Flow Enforcement Continuous Monitoring Configuration Settings Least Functionality Boundary Protection Information Input Validation Information Output Filtering Access Enforcement Information Flow Enforcement Continuous Monitoring Configuration Settings Least Functionality Boundary Protection Information Input Validation Information Output Filtering System Monitoring	OWASP ASVS V13.2.1: Resource Limiting	—

#	Target	Business Value	Source	Description	Conf.	Severity	Risk Signals	CAPEC	MITRE Techniques	MITRE Mitigations	D3FEND Mitigations	CIS Mitigations	NIST Mitigations	OWASP Mitigations	Detection (SOC)
1	ProductSvcToDB	N/A	pytm	Credentials in dataflow from Product Microservice to Product Database are sent over an unencrypted channel. TK-4F8D9568	1.00	CRITICAL (10.0)	NET D3F	CAPEC-216: Communication Channel Manipulation CAPEC-545: Pull Data From System Resources CAPEC-568: Capture Credentials via Keylogger CAPEC-622: Electromagnetic Side-Channel Attack CAPEC-637: Collect Data from Clipboard CAPEC-647: Collect Data from Registries CAPEC-648: Collect Data from Screen Capture CAPEC-675: Retrieve Data from Decommissioned Devices	T1005: Data from Local System T1056: Input Capture T1115: Clipboard Data T1012: Query Registry T1113: Screen Capture T1052: Exfiltration Over Physical Medium	M1057: Data Loss Prevention M1057: Data Loss Prevention M1034: Limit Hardware Installation M1042: Disable or Remove Feature or Program	D3-IOPR: IO Port Restriction Limiting access to computer input/output (IO) ports to restrict unauthorized devices. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities.	CIS 2.3: Address Unauthorized Software CIS 2.5: Allowlist Authorized Software CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 10.3: Disable Autorun and Autoplay for Removable Media CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Account Management Data Mining Protection Access Enforcement Least Privilege Information Location System Backup Security and Privacy Engineering Principles Cryptographic Protection Protection of Information at Rest Operations Security Malicious Code Protection System Monitoring Security and Privacy Attributes Account Management Use of External Systems Data Mining Protection Access Enforcement Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality System Component Inventory Media Use Vulnerability Monitoring and Scanning Security and Privacy Engineering Principles Protection of Information at Rest Port and I/O Device Access Malicious Code Protection System Monitoring Provenance	No specific OWASP mitigations found.	—
2	Product Database	N/A	pytm	Unauthorized access to sensitive data stored in Product Database leading to data breach TK-51637170	1.00	CRITICAL (10.0)	D3F	CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs *	T1078: Valid Accounts *	M1027: Password Policies M1018: User Account Management M1026: Privileged Account Management M1032: Multi-factor Authentication M1013: Application Developer Guidance M1017: User Training M1015: Active Directory Configuration M1036: Account Use Policies	D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-AL: Account Locking The process of temporarily disabling user accounts on a system or domain. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile.	CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding	Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Access Restrictions for Change Configuration Settings Identity Proofing Identification and Authentication (organizational Users) Authenticator Management Vulnerability Monitoring and Scanning Developer Configuration Management Developer Testing and Evaluation Development Process, Standards, and Tools Developer-provided Training Developer Security and Privacy Architecture and Design System Development Life Cycle Acquisition Process Security and Privacy Engineering Principles Protection of Information at Rest System Monitoring Supplier Assessments and Reviews	OWASP ASVS V2.1.1: Password Strength Requirements	—
3	Auth Service	N/A	pytm	Insecure security configuration or hardening on Auth Service leading to information exposure TK-4CC6AC19	1.00	HIGH (8.8)	D3F	CAPEC-511: Infiltration of Software Development Environment	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
4	ProductSvcToDB	N/A	pytm	Data interception on an unencrypted channel from Product Microservice to Product Database (Man-in-the-Middle attack) TK-7C2D8A69	1.00	HIGH (8.4)	NET D3F	CAPEC-545: Pull Data From System Resources CAPEC-622: Electromagnetic Side-Channel Attack CAPEC-637: Collect Data from Clipboard CAPEC-647: Collect Data from Registries CAPEC-648: Collect Data from Screen Capture CAPEC-675: Retrieve Data from Decommissioned Devices CAPEC-117: Interception CAPEC-204: Lifting Sensitive Data Embedded in Cache CAPEC-216: Communication Channel Manipulation CAPEC-261: Fuzzing for Garnering Other Adjacent user/sensitive data	T1005: Data from Local System T1115: Clipboard Data T1012: Query Registry T1113: Screen Capture T1052: Exfiltration Over Physical Medium	M1057: Data Loss Prevention M1057: Data Loss Prevention M1034: Limit Hardware Installation M1042: Disable or Remove Feature or Program	D3-IOPR: IO Port Restriction Limiting access to computer input/output (IO) ports to restrict unauthorized devices. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities.	CIS 2.3: Address Unauthorized Software CIS 2.5: Allowlist Authorized Software CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 10.3: Disable Autorun and Autoplay for Removable Media CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Account Management Data Mining Protection Access Enforcement Least Privilege Information Location System Backup Security and Privacy Engineering Principles Cryptographic Protection Protection of Information at Rest Operations Security Malicious Code Protection System Monitoring Security and Privacy Attributes Account Management Use of External Systems Data Mining Protection Access Enforcement Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality System Component Inventory Media Use Vulnerability Monitoring and Scanning Security and Privacy Engineering Principles Protection of Information at Rest Port and I/O Device Access Malicious Code Protection System Monitoring Provenance	No specific OWASP mitigations found.	—
5	Product Database	N/A	pytm	Insecure security configuration or hardening on Product Database leading to information exposure TK-205622DC	1.00	HIGH (8.3)	D3F	CAPEC-511: Infiltration of Software Development Environment	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
6	Product Microservice	N/A	pytm	Insecure security configuration or hardening on Product Microservice leading to information exposure TK-C4784043	1.00	HIGH (8.1)	D3F	CAPEC-511: Infiltration of Software Development Environment	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
7	CI/CD Server	N/A	pytm	Insecure security configuration or hardening on CI/CD Server leading to information exposure TK-1002C678	1.00	HIGH (8.0)	D3F	CAPEC-511: Infiltration of Software Development Environment	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
8	CI/CD Server	N/A	AI	(AI) CI/CD Server Logs Contain Stored Credentials and Deployment Secrets: The CI/CD Server manages deployment credentials and lacks described log protection controls. CI/CD system logs often capture command output, including database connection strings, API keys, and SSH private keys. If log storage is accessible without adequate restrictions, an attacker can extract these long-term credentials. TK-567ABFE1	0.90	HIGH (8.6)	D3F	CAPEC-245: XSS Using Doubled Characters CAPEC-510: SaaS User Request Forgery CAPEC-568: Capture Credentials via Keylogger CAPEC-11: Cause Web Server Misclassification CAPEC-54: Query System for Information CAPEC-545: Pull Data From System Resources CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-580: System Footprinting CAPEC-639: Probe System Files CAPEC-643: Identify Shared Files/Directories on System CAPEC-648: Collect Data from Screen Capture	T1056: Input Capture T1036: Masquerading T1005: Data from Local System T1040: Network Sniffing T1082: System Information Discovery T1039: Data from Network Shared Drive T1135: Network Share Discovery T1113: Screen Capture	M1047: Audit M1018: User Account Management M1017: User Training M1045: Code Signing M1040: Behavior Prevention on Endpoint M1022: Restrict File and Directory Permissions M1049: Antivirus/Antimalware M1038: Execution Prevention M1057: Data Loss Prevention M1018: User Account Management M1032: Multi-factor Authentication M1041: Encrypt Sensitive Information M1030: Network Segmentation M1028: Operating System Configuration	D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-SBV: Service Binary Verification Analyzing changes in service binary files by comparing to a source of truth. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-PH: Platform Hardening	CIS 2.5: Allowlist Authorized Software CIS 2.7: Allowlist Authorized Scripts CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 3.1: Establish and Maintain a Data Management Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.6: Securely Manage Enterprise Assets and Software CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality Service Identification and Authentication Information Input Validation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Security and Privacy Attributes Account Management Data Mining Protection Access Enforcement Least Privilege Information Location System Backup Security and Privacy Engineering Principles Cryptographic Protection Protection of Information at Rest Operations Security Malicious Code Protection System Monitoring Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Identification and Authentication (organizational Users) Authenticator Management Information in Shared System Resources Transmission Confidentiality and Integrity Information Management and Retention System Monitoring Software, Firmware, and Information Integrity Configuration Settings Least Functionality System Monitoring	OWASP ASVS V9.1: Communication Security	🔍 HIGH Missing logs (4) CI/CD server file integrity monitoring — changes to log files and credential configuration files Cloud storage access logs — CI/CD log bucket access and object retrieval events SIEM log integrity monitoring — log deletion or modification events Endpoint detection logs — processes accessing credential storage or log directories SIEM rules (3) CI/CD server log access by non-authorized processes `event_type=file_access AND target_path contains 'ci_log' OR target_path contains 'pipeline_log' AND user not in ci_admins` CI/CD server log files containing credential patterns — regex match on log content `event_type=log_content_analysis AND (regex_match '((password\|secret\|key)[\s=:][^\s]+)' OR regex_match '-----BEGIN (RSA \|EC )?PRIVATE KEY-----')` Unusual CI/CD server log file size or deletion events `event_type=file_modification AND target_path contains 'ci_log' AND (file_size_change > 1MB OR event_type=file_delete)` IOCs (3) Database connection strings in CI/CD pipeline configuration files (e.g., 'postgresql://user:pass@host/db') API keys and tokens in plaintext within pipeline YAML or JSON files SSH private key blocks embedded in pipeline scripts or environment variables
9	public cloud zone	N/A	AI	(AI) Misconfigured Cloud Storage Bucket Exposes Customer Data and Payment Records: The Public Cloud Zone represents the untrusted network-cloud-provider boundary. If cloud storage resources (e.g., S3, Blob, or Persistent Disk) associated with the e-commerce system are misconfigured with public read access or excessive IAM permissions, all stored customer PII and PCI DSS payment data becomes publicly accessible without authentication. TK-9CE2CC00	0.90	HIGH (8.2)	NET D3F	CAPEC-319: IP (DF) 'Don't Fragment Bit' Echoing Probe CAPEC-616: Establish Rogue Location	T1036: Masquerading	M1047: Audit M1018: User Account Management M1017: User Training M1045: Code Signing M1040: Behavior Prevention on Endpoint M1022: Restrict File and Directory Permissions M1049: Antivirus/Antimalware M1038: Execution Prevention	D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-SBV: Service Binary Verification Analyzing changes in service binary files by comparing to a source of truth. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment.	CIS 2.5: Allowlist Authorized Software CIS 2.7: Allowlist Authorized Scripts CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Account Management Access Enforcement Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality Service Identification and Authentication Information Input Validation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	🔍 HIGH Missing logs (3) Cloud provider S3/Blob audit logs — bucket policy changes and GetObject calls VPC Flow Logs — outbound connections to unknown endpoints from compute instances IAM Access Analyzer findings — unexpected public access grants SIEM rules (3) Public bucket policy modification `eventName=PutBucketPolicy AND (requestParameters.bucketName:.example-shop.com OR requestParameters.bucketName:.ecom-prod.)` Unauthorized object download from storage* `eventName=GetObject AND sourceIP NOT IN (internal_trusted_ips) AND userIdentity.type=RootUser` S3 bucket enumeration via ListBucket `eventName=ListBucket AND sourceIP NOT IN (authorized_service_ips) AND userIdentity.arn NOT LIKE :role/` IOCs (3) Bucket names matching pattern: .backup, .export, .legacy IAM policy statements with Action: * and Resource: * Outbound DNS queries for bucket-name.s3.amazonaws.com from non-AWS hosts
10	CDN Load Balancer	N/A	pytm	Insecure security configuration or hardening on CDN Load Balancer leading to information exposure TK-8A0EDFDC	1.00	MEDIUM (7.0)	NET D3F	CAPEC-511: Infiltration of Software Development Environment	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
11	CDN Load Balancer	N/A	pytm	Weak SSL/TLS configuration or ciphers used by CDN Load Balancer leading to information disclosure TK-A2172D1B	1.00	MEDIUM (7.0)	NET D3F	CAPEC-17: Using Malicious Files *	T1557: Adversary-in-the-Middle *	M1037: Filter Network Traffic M1041: Encrypt Sensitive Information M1035: Limit Access to Resource Over Network M1042: Disable or Remove Feature or Program M1017: User Training M1031: Network Intrusion Prevention M1030: Network Segmentation	D3-NI: Network Isolation D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-NTA: Network Traffic Analysis D3-OTF: Outbound Traffic Filtering Restricting network traffic originating from a private host or enclave destined towards untrusted networks. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.6: Securely Manage Enterprise Assets and Software CIS 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS 7.7: Remediate Detected Vulnerabilities CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 13.3: Deploy a Network Intrusion Detection Solution CIS 13.4: Perform Traffic Filtering Between Network Segments CIS 13.8: Deploy a Network Intrusion Prevention Solution CIS 14.2: Train Workforce Members to Recognize Social Engineering Attacks CIS 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 18.2: Perform Periodic External Penetration Tests CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Use of External Systems Access Enforcement Information Flow Enforcement Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality System Component Inventory Vulnerability Monitoring and Scanning Session Authenticity Information in Shared System Resources Cross Domain Policy Enforcement Boundary Protection Transmission Confidentiality and Integrity Information Input Validation Information Management and Retention Information Output Filtering Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V9.1: Strong TLS Configuration	—
12	API Gateway	N/A	pytm	Insecure security configuration or hardening on API Gateway leading to information exposure TK-02046310	1.00	MEDIUM (7.0)	NET D3F	CAPEC-511: Infiltration of Software Development Environment	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
13	CDN Load Balancer → API Gateway → Product Microservice → Product Database	N/A	LLM	(RAG-LLM) Data Exfiltration Through API Gateway Misconfiguration: The attacker performs reconnaissance on the CDN Load Balancer and API Gateway to discover undocumented endpoints or misconfigured routing rules. Leveraging the HTTPS data flow between Gateway and Product Microservice, the attacker sends crafted requests that bypass intended access controls, causing the Product Database to exfiltrate customer payment data through the API Gateway to the external network. The attack exploits the trust boundary between the gateway and the microservice. TK-90AB23EC	0.70	CRITICAL (9.4)	⛔D3F	CAPEC-615: Evil Twin Wi-Fi Attack CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-158: Sniffing Network Traffic CAPEC-204: Lifting Sensitive Data Embedded in Cache CAPEC-261: Fuzzing for Garnering Other Adjacent user/sensitive data CAPEC-309: Network Topology Mapping CAPEC-37: Retrieve Embedded Sensitive Data CAPEC-412: Pretexting via Customer Service CAPEC-463: Padding Oracle Crypto Attack CAPEC-48: Passing Local Filenames to Functions That Expect a URL CAPEC-529: Malware-Directed Internal Reconnaissance	T1040: Network Sniffing T1111: Multi-Factor Authentication Interception T1005: Data from Local System T1016: System Network Configuration Discovery T1049: System Network Connections Discovery T1590: Gather Victim Network Information	M1018: User Account Management M1032: Multi-factor Authentication M1041: Encrypt Sensitive Information M1030: Network Segmentation M1017: User Training M1057: Data Loss Prevention M1056: Pre-compromise	D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-DE: Decoy Environment A Decoy Environment comprises hosts and networks for the purposes of deceiving an attacker. D3-DO: Decoy Object A Decoy Object is created and deployed for the purposes of deceiving attackers.	CIS 3.1: Establish and Maintain a Data Management Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.6: Securely Manage Enterprise Assets and Software CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 14.1: Establish and Maintain a Security Awareness Program CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 18.2: Perform Periodic External Penetration Tests CIS 18.3: Remediate Penetration Test Findings	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Identification and Authentication (organizational Users) Authenticator Management Information in Shared System Resources Transmission Confidentiality and Integrity Information Management and Retention System Monitoring Software, Firmware, and Information Integrity Continuous Monitoring Baseline Configuration Configuration Settings Identification and Authentication (organizational Users) Authenticator Management Malicious Code Protection System Monitoring Security and Privacy Attributes Account Management Data Mining Protection Access Enforcement Least Privilege Information Location System Backup Security and Privacy Engineering Principles Cryptographic Protection Protection of Information at Rest Operations Security Malicious Code Protection System Monitoring	OWASP ASVS V9.1: Communication Security	—
14	secure data zone	N/A	AI	(AI) Unencrypted Data Exposure via Trust Boundary Misconfiguration: The Secure Data Zone is tagged with N/A technology tags and has unknown encryption at rest status. As a network-cloud-security-group trust boundary with no specified authentication, inbound or outbound traffic crossing this boundary may expose sensitive data if not properly encrypted. The absence of specified security controls (WAF, IDS, IPS) increases the risk of unauthorized data reading. TK-BFE87B4B	0.90	HIGH (7.6)	NET D3F	CAPEC-617: Cellular Rogue Base Station CAPEC-624: Hardware Fault Injection CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-158: Sniffing Network Traffic CAPEC-204: Lifting Sensitive Data Embedded in Cache CAPEC-261: Fuzzing for Garnering Other Adjacent user/sensitive data CAPEC-37: Retrieve Embedded Sensitive Data CAPEC-155: Screen Temporary Files for Sensitive Information CAPEC-190: Reverse Engineer an Executable to Expose Assumed Hidden Functionality CAPEC-191: Read Sensitive Constants Within an Executable CAPEC-291: DNS Zone Transfers CAPEC-309: Network Topology Mapping	T1040: Network Sniffing T1111: Multi-Factor Authentication Interception T1005: Data from Local System T1552: Unsecured Credentials T1016: System Network Configuration Discovery T1049: System Network Connections Discovery T1590: Gather Victim Network Information	M1018: User Account Management M1032: Multi-factor Authentication M1041: Encrypt Sensitive Information M1030: Network Segmentation M1017: User Training M1057: Data Loss Prevention M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management M1056: Pre-compromise	D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-DE: Decoy Environment A Decoy Environment comprises hosts and networks for the purposes of deceiving an attacker. D3-DO: Decoy Object A Decoy Object is created and deployed for the purposes of deceiving attackers.	CIS 3.1: Establish and Maintain a Data Management Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.6: Securely Manage Enterprise Assets and Software CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 14.1: Establish and Maintain a Security Awareness Program CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 18.2: Perform Periodic External Penetration Tests CIS 18.3: Remediate Penetration Test Findings	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Identification and Authentication (organizational Users) Authenticator Management Information in Shared System Resources Transmission Confidentiality and Integrity Information Management and Retention System Monitoring Software, Firmware, and Information Integrity Continuous Monitoring Baseline Configuration Configuration Settings Identification and Authentication (organizational Users) Authenticator Management Malicious Code Protection System Monitoring Security and Privacy Attributes Account Management Data Mining Protection Access Enforcement Least Privilege Information Location System Backup Security and Privacy Engineering Principles Cryptographic Protection Protection of Information at Rest Operations Security Malicious Code Protection System Monitoring Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V9.1: Communication Security	🔍 LOW Missing logs (3) Network flow logs — TLS handshake metadata and SNI from database tier Host-based firewall logs — allowed/denied rules for database connections Database audit logs — connection encryption status and TLS version used SIEM rules (3) Unencrypted database traffic detection `protocol=tcp AND destinationPort=5432 AND tls_version IS NULL AND encryption_mode=none` Cross-zone traffic without TLS `src_zone=public AND dst_zone=secure_data AND transport=tcp AND tls_enabled=false` Data exfiltration via unencrypted channel `direction=outbound AND protocol=tcp AND (destPort IN (3306,5432,1433) AND tls_version IS NULL)` IOCs (3) Database connection strings missing :sslmode= or :encrypt=true parameters TLS certificate expiration events from load balancers pointing to database endpoints Unencrypted protocol signatures: MySQL handshake v10.x, PostgreSQL startup packet

#	Target	Business Value	Source	Description	Conf.	Severity	Risk Signals	CAPEC	MITRE Techniques	MITRE Mitigations	D3FEND Mitigations	CIS Mitigations	NIST Mitigations	OWASP Mitigations	Detection (SOC)
1	Auth Service	N/A	pytm	Lack of monitoring or logging on Auth Service, preventing detection of malicious activities and enabling repudiation TK-C6C35E64	1.00	CRITICAL (9.4)	D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
2	Product Database	N/A	pytm	Lack of monitoring or logging on Product Database, preventing detection of malicious activities and enabling repudiation TK-B193D327	1.00	HIGH (8.9)	D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
3	Product Microservice	N/A	pytm	Lack of monitoring or logging on Product Microservice, preventing detection of malicious activities and enabling repudiation TK-A8131F1E	1.00	HIGH (8.7)	D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
4	CI/CD Server	N/A	pytm	Lack of monitoring or logging on CI/CD Server, preventing detection of malicious activities and enabling repudiation TK-27EFB40D	1.00	HIGH (8.6)	D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
5	CDN Load Balancer	N/A	pytm	Lack of monitoring or logging on CDN Load Balancer, preventing detection of malicious activities and enabling repudiation TK-92C6E96A	1.00	HIGH (7.6)	NET D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
6	API Gateway	N/A	pytm	Lack of monitoring or logging on API Gateway, preventing detection of malicious activities and enabling repudiation TK-2977BCA7	1.00	HIGH (7.6)	NET D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
7	End User	N/A	pytm	Repudiation of critical actions performed by End User due to insufficient logging or non-repudiation controls TK-447072F3	1.00	MEDIUM (7.0)	NET D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
8	DevOps Engineer	N/A	pytm	Repudiation of critical actions performed by DevOps Engineer due to insufficient logging or non-repudiation controls TK-17D5FA20	1.00	MEDIUM (7.0)	NET D3F	CAPEC-195: Principal Spoof CAPEC-268: Audit Log Manipulation CAPEC-571: Block Logging to Central Repository CAPEC-587: Cross Frame Scripting (XFS) CAPEC-599: Terrestrial Jamming CAPEC-67: String Format Overflow in syslog() CAPEC-81: Web Server Logs Tampering CAPEC-93: Log Injection-Tampering-Forging	T1070: Indicator Removal T1562: Impair Defenses	M1041: Encrypt Sensitive Information M1029: Remote Data Storage M1022: Restrict File and Directory Permissions M1054: Software Configuration M1018: User Account Management M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1047: Audit M1042: Disable or Remove Feature or Program	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.3: Configure Data Access Control Lists CIS 3.4: Enforce Data Retention CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 8.1: Establish and Maintain an Audit Log Management Process CIS 8.2: Collect Audit Logs CIS 8.3: Ensure Adequate Audit Log Storage CIS 8.9: Centralize Audit Logs CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Alternate Storage Site Alternate Processing Site System Backup Distributed Processing and Storage Information in Shared System Resources Information Management and Retention Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	OWASP ASVS V7.1: Logging and Auditing OWASP ASVS V7.1: Immutable and Protected Logs	—
9	secure data zone	N/A	AI	(AI) Inability to Audit Cross-Boundary Traffic Due to Missing Controls: The Secure Data Zone has no specified authentication, WAF, IDS, IPS, or encryption at rest. This lack of controls makes it difficult to audit who accessed what data and when, potentially enabling repudiation of actions by malicious insiders or attackers. TK-A4DB608B	0.90	HIGH (7.6)	NET D3F	CAPEC-655: Avoid Security Tool Identification by Adding Data CAPEC-661: Root/Jailbreak Detection Evasion via Debugging	T1027: Obfuscated Files or Information	M1047: Audit M1040: Behavior Prevention on Endpoint M1017: User Training M1049: Antivirus/Antimalware	D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.	CIS 10.1: Deploy and Maintain Anti-Malware Software CIS 10.2: Configure Automatic Anti-Malware Signature Updates CIS 10.7: Use Behavior-Based Anti-Malware Software CIS 13.2: Deploy a Host-Based Intrusion Detection Solution CIS 13.7: Deploy a Host-Based Intrusion Prevention Solution	Baseline Configuration Configuration Settings Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	🔍 LOW Missing logs (3) Comprehensive audit log aggregation — cross-zone access events with user identity WAF/Proxy logs — request/response metadata with user-agent and session IDs File integrity monitoring — changes to sensitive data files with user attribution SIEM rules (3) Cross-boundary access without audit trail `eventType=access AND zone=secure_data AND auditId IS NULL AND time > 24h` Repudiation risk — missing user attribution `userIdentity IS NULL AND action=read AND resource=customer_data AND zone=secure_data` Insider data access without logging `processName IN (sqlplus, psql, mysql) AND queryType=SELECT AND user IS NULL AND zone=secure_data` IOCs (3) Missing or corrupted audit log files in /var/log/audit* or EventLog Process names mimicking legitimate admin tools without corresponding session IDs Data access events with zero metadata: no source IP, no user agent, no timestamp correlation

#	Target	Business Value	Source	Description	Conf.	Severity	Risk Signals	CAPEC	MITRE Techniques	MITRE Mitigations	D3FEND Mitigations	CIS Mitigations	NIST Mitigations	OWASP Mitigations	Detection (SOC)
1	End User	N/A	AI	(AI) Credential Stuffing Attack Against OIDC Authentication: Attacker leverages credential reuse from other breaches to gain unauthorized access to user accounts via the OIDC/OAuth2 authentication flow. The absence of WAF/IDS/IPS on the End User component allows automated credential submission at scale. TK-F71618E0	0.90	CRITICAL (10.0)	NET ⛔D3F	CAPEC-617: Cellular Rogue Base Station CAPEC-609: Cellular Traffic Intercept	T1111: Multi-Factor Authentication Interception	M1017: User Training	No specific D3FEND mitigations found.	CIS 14.1: Establish and Maintain a Security Awareness Program CIS 14.3: Train Workforce Members on Authentication Best Practices	Continuous Monitoring Baseline Configuration Configuration Settings Identification and Authentication (organizational Users) Authenticator Management Malicious Code Protection System Monitoring	No specific OWASP mitigations found.	🔍 MEDIUM Missing logs (3) Cloud proxy authentication logs — failed OIDC login attempts with source IP and user agent API Gateway access logs — request rate per source IP and per client identifier WAF logs — known credential stuffing patterns and blocked requests SIEM rules (2) High volume of failed OIDC authentication from single source IP `event_type=authentication_failure AND auth_type=oidc AND src_ip=* AND count > 20 within 5m` Successful OIDC login from anomalous client or location `event_type=authentication_success AND auth_type=oidc AND (src_ip in anomalous_ips OR user_agent not in known_browsers)` IOCs (3) Automated credential stuffing tool user agents (e.g., 'Bingbot', 'python-requests/2', custom bot signatures) Known breached credential patterns targeting OIDC login endpoints IP ranges associated with proxy services and VPNs used in credential stuffing campaigns
2	API Gateway	N/A	pytm	Weak or missing authentication on routes managed by API Gateway API Gateway, allowing unauthorized access to backend services. TK-9EC48851	1.00	CRITICAL (10.0)	NET D3F	CAPEC-159: Redirect Access to Libraries	T1574: Hijack Execution Flow	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
3	GatewayToAuth	N/A	pytm	Potential for spoofing attacks on data crossing trust boundaries from API Gateway to Auth Service without proper authentication TK-D282F4E1	1.00	CRITICAL (10.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-412: Pretexting via Customer Service CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
4	GatewayToProductSvc	N/A	pytm	Potential for spoofing attacks on data crossing trust boundaries from API Gateway to Product Microservice without proper authentication TK-DAD8E162	1.00	CRITICAL (10.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
5	DevOpsToCICD	N/A	pytm	Potential for spoofing attacks on data crossing trust boundaries from DevOps Engineer to CI/CD Server without proper authentication TK-FCA1A540	1.00	CRITICAL (10.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
6	End User	N/A	pytm	Actor End User uses single-factor authentication (credentials only), increasing risk from phishing and credential stuffing. TK-89CA37CC	1.00	CRITICAL (10.0)	NET D3F	CAPEC-163: Spear Phishing CAPEC-164: Mobile Phishing CAPEC-654: Credential Prompt Impersonation CAPEC-656: Voice Phishing CAPEC-98: Phishing	T1534: Internal Spearphishing T1056: Input Capture T1566: Phishing T1598: Phishing for Information	M1047: Audit M1031: Network Intrusion Prevention M1054: Software Configuration M1021: Restrict Web-Based Content M1049: Antivirus/Antimalware M1017: User Training M1017: User Training M1054: Software Configuration	D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-NTA: Network Traffic Analysis D3-OTF: Outbound Traffic Filtering Restricting network traffic originating from a private host or enclave destined towards untrusted networks. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-DNSAL: DNS Allowlisting Permitting only approved domains and their subdomains to be resolved. D3-DNSDL: DNS Denylisting Blocking DNS Network Traffic based on criteria such as IP address, domain name, or DNS query type. D3-FA: File Analysis D3-UA: URL Analysis Determining if a URL is benign or malicious by analyzing the URL or its components. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.	CIS 2.3: Address Unauthorized Software CIS 2.7: Allowlist Authorized Scripts CIS 9.3: Maintain and Enforce Network-Based URL Filters CIS 9.6: Block Unnecessary File Types CIS 13.3: Deploy a Network Intrusion Detection Solution CIS 13.8: Deploy a Network Intrusion Prevention Solution CIS 14.1: Establish and Maintain a Security Awareness Program CIS 14.2: Train Workforce Members to Recognize Social Engineering Attacks CIS 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents CIS 14.1: Establish and Maintain a Security Awareness Program CIS 14.2: Train Workforce Members to Recognize Social Engineering Attacks CIS 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents	Information Flow Enforcement Continuous Monitoring Baseline Configuration Configuration Settings Service Identification and Authentication Secure Name/address Resolution Service (authoritative Source) Detonation Chambers Boundary Protection Flaw Remediation Malicious Code Protection System Monitoring Spam Protection Information Flow Enforcement Continuous Monitoring Baseline Configuration Configuration Settings Service Identification and Authentication Secure Name/address Resolution Service (authoritative Source) Detonation Chambers Boundary Protection Malicious Code Protection System Monitoring Spam Protection	OWASP ASVS V2: Strong Authentication	—
7	API Gateway	N/A	AI	(AI) API Gateway Token Replay Attack: The API Gateway accepts HTTPS requests with authentication tokens. If token replay protection is not enforced at the gateway level, an attacker who captures a valid token (e.g., via network sniffing or XSS) can replay it to gain unauthorized access to downstream services. TK-14E3000A	0.90	CRITICAL (10.0)	NET D3F	CAPEC-611: BitSquatting CAPEC-132: Symlink Attack CAPEC-159: Redirect Access to Libraries CAPEC-615: Evil Twin Wi-Fi Attack CAPEC-628: Carry-Off GPS Attack CAPEC-632: Homograph Attack via Homoglyphs CAPEC-633: Token Impersonation	T1547: Boot or Logon Autostart Execution T1574: Hijack Execution Flow T1134: Access Token Manipulation	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1018: User Account Management M1026: Privileged Account Management	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Separation of Duties Least Privilege Access Restrictions for Change Configuration Settings Identification and Authentication (organizational Users)	No specific OWASP mitigations found.	🔍 HIGH Missing logs (3) API Gateway request logs — token ID, token nonce, and token expiration timestamp per request API Gateway access logs — token reuse detection (same token ID used in multiple requests within short time) WAF logs — token replay attacks and suspicious token patterns SIEM rules (3) Token reuse detection — same access token ID used in multiple requests `event_type=api_request AND token_id=* AND count > 1 within 10m grouped by token_id` API request with expired or malformed token `event_type=api_request AND (token_status=expired OR token_status=invalid OR token_length < 20)` Suspicious token issuance — OIDC tokens issued outside of normal authentication flow `event_type=token_issue AND (issuer not in trusted_issuers OR token_type != 'access')` IOCs (3) Valid OIDC access token values captured in network traffic (base64-encoded JWT strings) Token reuse patterns: same 'jti' or 'sub' value across multiple API requests Client-side scripts injecting tokens into request headers outside of expected authentication middleware
8	CDN Load Balancer	N/A	pytm	Session hijacking or fixation attack against the CDN Load Balancer leading to unauthorized access TK-25266B85	1.00	CRITICAL (9.0)	NET D3F	CAPEC-132: Symlink Attack CAPEC-159: Redirect Access to Libraries CAPEC-471: Search Order Hijacking CAPEC-615: Evil Twin Wi-Fi Attack CAPEC-628: Carry-Off GPS Attack CAPEC-632: Homograph Attack via Homoglyphs	T1547: Boot or Logon Autostart Execution T1574: Hijack Execution Flow	M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions	D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-SU: Software Update Replacing old software on a computer system component. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
9	UserToGateway	N/A	pytm	Spoofing of data from End User to API Gateway due to lack of authentication TK-8EB6BBA0	1.00	CRITICAL (9.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
10	GatewayToAuth	N/A	pytm	Spoofing of data from API Gateway to Auth Service due to lack of authentication TK-14B0A5C1	1.00	CRITICAL (9.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-412: Pretexting via Customer Service CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
11	GatewayToProductSvc	N/A	pytm	Spoofing of data from API Gateway to Product Microservice due to lack of authentication TK-9DE98456	1.00	CRITICAL (9.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
12	ProductSvcToDB	N/A	pytm	Spoofing of data from Product Microservice to Product Database due to lack of authentication TK-781DA0C1	1.00	CRITICAL (9.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
13	DevOpsToCICD	N/A	pytm	Spoofing of data from DevOps Engineer to CI/CD Server due to lack of authentication TK-F0E6C9D6	1.00	CRITICAL (9.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
14	CICDToProductSvc	N/A	pytm	Spoofing of data from CI/CD Server to Product Microservice due to lack of authentication TK-0FBDE87C	1.00	CRITICAL (9.0)	NET D3F	CAPEC-145: Checksum Spoofing CAPEC-151: Identity Spoofing CAPEC-154: Resource Location Spoofing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-474: Signature Spoofing by Key Theft CAPEC-475: Signature Spoofing by Improper Validation CAPEC-476: Signature Spoofing by Misrepresentation CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content	T1552: Unsecured Credentials	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
15	End User	N/A	pytm	Identity spoofing of the actor End User via phishing or credential theft TK-6593AE3E	1.00	CRITICAL (9.0)	NET D3F	CAPEC-151: Identity Spoofing CAPEC-474: Signature Spoofing by Key Theft CAPEC-145: Checksum Spoofing CAPEC-154: Resource Location Spoofing CAPEC-163: Spear Phishing CAPEC-164: Mobile Phishing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-475: Signature Spoofing by Improper Validation	T1552: Unsecured Credentials T1534: Internal Spearphishing	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
16	DevOps Engineer	N/A	pytm	Identity spoofing of the actor DevOps Engineer via phishing or credential theft TK-89E634AB	1.00	CRITICAL (9.0)	NET D3F	CAPEC-151: Identity Spoofing CAPEC-474: Signature Spoofing by Key Theft CAPEC-145: Checksum Spoofing CAPEC-154: Resource Location Spoofing CAPEC-163: Spear Phishing CAPEC-164: Mobile Phishing CAPEC-173: Action Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages CAPEC-389: Content Spoofing Via Application API Manipulation CAPEC-475: Signature Spoofing by Improper Validation	T1552: Unsecured Credentials T1534: Internal Spearphishing	M1041: Encrypt Sensitive Information M1051: Update Software M1017: User Training M1015: Active Directory Configuration M1027: Password Policies M1028: Operating System Configuration M1037: Filter Network Traffic M1022: Restrict File and Directory Permissions M1035: Limit Access to Resource Over Network M1047: Audit M1026: Privileged Account Management	D3-DENCR: Disk Encryption Encrypting a hard disk partition to prevent cleartext access to a file system. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-FE: File Encryption Encrypting a file using a cryptographic key. D3-MENCR: Message Encryption Encrypting a message body using a cryptographic key. D3-SU: Software Update Replacing old software on a computer system component. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-PH: Platform Hardening D3-NI: Network Isolation D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.	CIS 3.1: Establish and Maintain a Data Management Process CIS 3.2: Establish and Maintain a Data Inventory CIS 3.3: Configure Data Access Control Lists CIS 3.11: Encrypt Sensitive Data At Rest CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.2: Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS 4.5: Implement and Manage a Firewall on End-User Devices CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 11.3: Protect Recovery Data CIS 13.1: Perform Application Layer Filtering CIS 14.3: Train Workforce Members on Authentication Best Practices CIS 14.4: Train Workforce on Data Handling Best Practices CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Security and Privacy Attributes Remote Access Wireless Access Access Control for Mobile Devices Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Device Identification and Authentication Identifier Management Authenticator Management Vulnerability Monitoring and Scanning Developer Testing and Evaluation Development Process, Standards, and Tools Cryptographic Key Establishment and Management Protection of Information at Rest Information in Shared System Resources Boundary Protection Information Input Validation Information Management and Retention Information Output Filtering Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
17	secure data zone	N/A	AI	(AI) IP Spoofing to Bypass Trust Boundary Controls: Without specified authentication protocols and with unknown security control effectiveness, an attacker could spoof source IP addresses to appear as trusted traffic entering or leaving the Secure Data Zone. If the network-cloud-security-group relies on IP-based allowlisting, spoofed IPs could bypass these checks. TK-358C9651	0.90	HIGH (7.8)	NET D3F	CAPEC-169: Footprinting	T1217: Browser Information Discovery T1592: Gather Victim Host Information T1595: Active Scanning	M1056: Pre-compromise M1056: Pre-compromise	D3-DE: Decoy Environment A Decoy Environment comprises hosts and networks for the purposes of deceiving an attacker. D3-DO: Decoy Object A Decoy Object is created and deployed for the purposes of deceiving attackers.	CIS 18.2: Perform Periodic External Penetration Tests CIS 18.3: Remediate Penetration Test Findings	No specific NIST mitigations found.	OWASP ASVS V1.1.1: Secure Software Development Lifecycle OWASP ASVS V7.4.1: Sensitive Information in Error Messages OWASP ASVS V14.2.1: Automated Vulnerability Scanning	🔍 LOW Missing logs (3) Network packet captures — IP header validation and spoofing detection EDR network connection logs — source IP validation against AD identity Cloud security group flow logs — IP spoofing detection at infrastructure level SIEM rules (3) IP spoofing detection via ingress filtering `srcIP IN trusted_internal_ips AND dstZone=public AND interface=ingress AND ipHeaderValidation=fail` Source IP inconsistency with TLS certificate `srcIP NOT IN certificateSANs AND transport=tls AND eventName=certificateValidation` ARP spoofing detection on segment `macAddress CHANGE AND ipStability DECREASE AND segment=secure_data` IOCs (3) Source IPs from private ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x) appearing in public zone Invalid checksum packets with spoofed source addresses Gateway IP mismatches: srcIP gateway != expected infrastructure gateway

#	Target	Business Value	Source	Description	Conf.	Severity	Risk Signals	CAPEC	MITRE Techniques	MITRE Mitigations	D3FEND Mitigations	CIS Mitigations	NIST Mitigations	OWASP Mitigations	Detection (SOC)
1	CDN Load Balancer	N/A	pytm	Unpatched OS or software vulnerabilities on CDN Load Balancer leading to system compromise TK-1BAB7BF5	1.00	CRITICAL (10.0)	NET D3F	CAPEC-166: Force the System to Reset Values CAPEC-184: Software Integrity Attack CAPEC-185: Malicious Software Download CAPEC-186: Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-442: Infected Software CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-511: Infiltration of Software Development Environment CAPEC-519: Documentation Alteration to Cause Errors in System Design	T1195: Supply Chain Compromise T1072: Software Deployment Tools	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1018: User Account Management M1015: Active Directory Configuration M1051: Update Software M1026: Privileged Account Management M1027: Password Policies M1033: Limit Software Installation M1030: Network Segmentation M1017: User Training M1032: Multi-factor Authentication M1029: Remote Data Storage	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 15.7: Securely Decommission Service Providers CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Session Termination Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Authenticator Management Cryptographic Key Establishment and Management Public Key Infrastructure Certificates Cross Domain Policy Enforcement Boundary Protection Flaw Remediation Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
2	API Gateway	N/A	pytm	Unpatched OS or software vulnerabilities on API Gateway leading to system compromise TK-BD2EECE3	1.00	CRITICAL (10.0)	NET D3F	CAPEC-166: Force the System to Reset Values CAPEC-184: Software Integrity Attack CAPEC-185: Malicious Software Download CAPEC-186: Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-442: Infected Software CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-511: Infiltration of Software Development Environment CAPEC-519: Documentation Alteration to Cause Errors in System Design	T1195: Supply Chain Compromise T1072: Software Deployment Tools	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1018: User Account Management M1015: Active Directory Configuration M1051: Update Software M1026: Privileged Account Management M1027: Password Policies M1033: Limit Software Installation M1030: Network Segmentation M1017: User Training M1032: Multi-factor Authentication M1029: Remote Data Storage	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 15.7: Securely Decommission Service Providers CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Session Termination Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Authenticator Management Cryptographic Key Establishment and Management Public Key Infrastructure Certificates Cross Domain Policy Enforcement Boundary Protection Flaw Remediation Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
3	API Gateway	N/A	pytm	Event injection vulnerability in serverless function API Gateway, leading to arbitrary code execution. TK-BB1DC13F	1.00	CRITICAL (10.0)	NET D3F	CAPEC-14: Client-side Injection-induced Buffer Overflow CAPEC-206: Signing Malicious Code CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-594: Traffic Injection CAPEC-596: TCP RST Injection CAPEC-624: Hardware Fault Injection CAPEC-625: Mobile Device Fault Injection CAPEC-635: Alternative Execution Due to Deceptive Filenames CAPEC-636: Hiding Malicious Data or Code within Files CAPEC-663: Exploitation of Transient Instruction Execution	T1553: Subvert Trust Controls T1036: Masquerading T1221: Template Injection	M1038: Execution Prevention M1028: Operating System Configuration M1026: Privileged Account Management M1024: Restrict Registry Permissions M1054: Software Configuration M1047: Audit M1018: User Account Management M1017: User Training M1045: Code Signing M1040: Behavior Prevention on Endpoint M1022: Restrict File and Directory Permissions M1049: Antivirus/Antimalware M1038: Execution Prevention M1049: Antivirus/Antimalware M1031: Network Intrusion Prevention M1017: User Training M1042: Disable or Remove Feature or Program	D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SBV: Service Binary Verification Analyzing changes in service binary files by comparing to a source of truth. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-NTA: Network Traffic Analysis D3-OTF: Outbound Traffic Filtering Restricting network traffic originating from a private host or enclave destined towards untrusted networks.	CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 2.7: Allowlist Authorized Scripts CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 2.3: Address Unauthorized Software CIS 2.7: Allowlist Authorized Scripts CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS 13.3: Deploy a Network Intrusion Detection Solution CIS 13.8: Deploy a Network Intrusion Prevention Solution CIS 14.1: Establish and Maintain a Security Awareness Program CIS 14.2: Train Workforce Members to Recognize Social Engineering Attacks CIS 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Least Privilege Penetration Testing Software Usage Restrictions Baseline Configuration Configuration Change Control Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Cryptographic Module Authentication Service Identification and Authentication Criticality Analysis Developer Configuration Management Developer Testing and Evaluation Non-modifiable Executable Programs Information Input Validation Flaw Remediation System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality Service Identification and Authentication Information Input Validation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality System Component Inventory Vulnerability Monitoring and Scanning Detonation Chambers Boundary Protection Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Spam Protection	No specific OWASP mitigations found.	—
4	End User	N/A	pytm	Untrusted actor End User may attempt to inject malicious data or exploit vulnerabilities in connected systems. TK-E50BACE2	1.00	CRITICAL (10.0)	NET D3F	CAPEC-636: Hiding Malicious Data or Code within Files CAPEC-153: Input Data Manipulation CAPEC-160: Exploit Script-Based APIs CAPEC-168: Windows ::DATA Alternate Data Stream CAPEC-185: Malicious Software Download CAPEC-186: Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection CAPEC-201: Serialized Data External Linking CAPEC-206: Signing Malicious Code CAPEC-221: Data Serialization External Entities Blowup	T1221: Template Injection T1195: Supply Chain Compromise T1072: Software Deployment Tools T1553: Subvert Trust Controls	M1049: Antivirus/Antimalware M1031: Network Intrusion Prevention M1017: User Training M1042: Disable or Remove Feature or Program M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1018: User Account Management M1015: Active Directory Configuration M1051: Update Software M1026: Privileged Account Management M1027: Password Policies M1033: Limit Software Installation M1030: Network Segmentation M1017: User Training M1032: Multi-factor Authentication M1029: Remote Data Storage M1038: Execution Prevention M1028: Operating System Configuration M1026: Privileged Account Management M1024: Restrict Registry Permissions M1054: Software Configuration	D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-NTA: Network Traffic Analysis D3-OTF: Outbound Traffic Filtering Restricting network traffic originating from a private host or enclave destined towards untrusted networks. D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections.	CIS 2.3: Address Unauthorized Software CIS 2.7: Allowlist Authorized Scripts CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS 13.3: Deploy a Network Intrusion Detection Solution CIS 13.8: Deploy a Network Intrusion Prevention Solution CIS 14.1: Establish and Maintain a Security Awareness Program CIS 14.2: Train Workforce Members to Recognize Social Engineering Attacks CIS 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 15.7: Securely Decommission Service Providers CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality System Component Inventory Vulnerability Monitoring and Scanning Detonation Chambers Boundary Protection Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Spam Protection Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Session Termination Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Authenticator Management Cryptographic Key Establishment and Management Public Key Infrastructure Certificates Cross Domain Policy Enforcement Boundary Protection Flaw Remediation Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Least Privilege Penetration Testing Software Usage Restrictions Baseline Configuration Configuration Change Control Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Cryptographic Module Authentication Service Identification and Authentication Criticality Analysis Developer Configuration Management Developer Testing and Evaluation Non-modifiable Executable Programs Information Input Validation Flaw Remediation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
5	Auth Service	N/A	pytm	Unpatched OS or software vulnerabilities on Auth Service leading to system compromise TK-908A66B7	1.00	CRITICAL (10.0)	D3F	CAPEC-166: Force the System to Reset Values CAPEC-184: Software Integrity Attack CAPEC-185: Malicious Software Download CAPEC-186: Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-442: Infected Software CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-478: Modification of Windows Service Configuration CAPEC-51: Poison Web Service Registry *	T1195: Supply Chain Compromise T1072: Software Deployment Tools T1574: Hijack Execution Flow T1543: Create or Modify System Process T1556: Modify Authentication Process *	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1018: User Account Management M1015: Active Directory Configuration M1051: Update Software M1026: Privileged Account Management M1027: Password Policies M1033: Limit Software Installation M1030: Network Segmentation M1017: User Training M1032: Multi-factor Authentication M1029: Remote Data Storage M1052: User Account Control M1040: Behavior Prevention on Endpoint M1044: Restrict Library Loading M1047: Audit M1013: Application Developer Guidance M1018: User Account Management M1051: Update Software M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1024: Restrict Registry Permissions M1018: User Account Management M1040: Behavior Prevention on Endpoint M1033: Limit Software Installation M1026: Privileged Account Management M1028: Operating System Configuration M1047: Audit M1054: Software Configuration M1022: Restrict File and Directory Permissions M1045: Code Signing M1024: Restrict Registry Permissions M1032: Multi-factor Authentication M1027: Password Policies M1022: Restrict File and Directory Permissions M1018: User Account Management M1026: Privileged Account Management M1025: Privileged Process Integrity M1047: Audit M1028: Operating System Configuration	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment. D3-PH: Platform Hardening D3-ACH: Application Configuration Hardening Modifying an application's configuration to reduce its attack surface. D3-CP: Certificate Pinning Persisting either a server's X.509 certificate or their public key and comparing that to server's presented identity to allow for greater client confidence in the remote server's identity for SSL connections. D3-SBV: Service Binary Verification Analyzing changes in service binary files by comparing to a source of truth.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 15.7: Securely Decommission Service Providers CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.13: Conduct Application Penetration Testing CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.3: Address Unauthorized Software CIS 2.5: Allowlist Authorized Software CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.6: Allowlist Authorized Libraries CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Session Termination Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Authenticator Management Cryptographic Key Establishment and Management Public Key Infrastructure Certificates Cross Domain Policy Enforcement Boundary Protection Flaw Remediation Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Vulnerability Monitoring and Scanning Information Input Validation Flaw Remediation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Remote Access Account Management Access Enforcement Separation of Duties Least Privilege Continuous Monitoring Penetration Testing User-installed Software Baseline Configuration Configuration Change Control Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Identifier Management Vulnerability Monitoring and Scanning Unsupported System Components Memory Protection Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity Account Management Use of External Systems Access Enforcement Separation of Duties Least Privilege Unsuccessful Logon Attempts Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality Identification and Authentication (organizational Users) Authenticator Management Process Isolation System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
6	Product Microservice	N/A	pytm	Unpatched OS or software vulnerabilities on Product Microservice leading to system compromise TK-0DA408D0	1.00	CRITICAL (10.0)	D3F	CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-166: Force the System to Reset Values CAPEC-184: Software Integrity Attack CAPEC-185: Malicious Software Download CAPEC-186: Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-442: Infected Software CAPEC-443: Malicious Logic Inserted Into Product by Authorized Developer CAPEC-446: Malicious Logic Insertion into Product via Inclusion of Third-Party Component	T1195: Supply Chain Compromise T1072: Software Deployment Tools	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1018: User Account Management M1015: Active Directory Configuration M1051: Update Software M1026: Privileged Account Management M1027: Password Policies M1033: Limit Software Installation M1030: Network Segmentation M1017: User Training M1032: Multi-factor Authentication M1029: Remote Data Storage	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 15.7: Securely Decommission Service Providers CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Session Termination Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Authenticator Management Cryptographic Key Establishment and Management Public Key Infrastructure Certificates Cross Domain Policy Enforcement Boundary Protection Flaw Remediation Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
7	Product Database	N/A	pytm	Unpatched OS or software vulnerabilities on Product Database leading to system compromise TK-47A75F3F	1.00	CRITICAL (10.0)	D3F	CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-166: Force the System to Reset Values CAPEC-184: Software Integrity Attack CAPEC-185: Malicious Software Download CAPEC-186: Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-442: Infected Software CAPEC-443: Malicious Logic Inserted Into Product by Authorized Developer CAPEC-446: Malicious Logic Insertion into Product via Inclusion of Third-Party Component	T1195: Supply Chain Compromise T1072: Software Deployment Tools	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1018: User Account Management M1015: Active Directory Configuration M1051: Update Software M1026: Privileged Account Management M1027: Password Policies M1033: Limit Software Installation M1030: Network Segmentation M1017: User Training M1032: Multi-factor Authentication M1029: Remote Data Storage	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 15.7: Securely Decommission Service Providers CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Session Termination Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Authenticator Management Cryptographic Key Establishment and Management Public Key Infrastructure Certificates Cross Domain Policy Enforcement Boundary Protection Flaw Remediation Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
8	Product Database	N/A	pytm	Data corruption or tampering in Product Database via unauthorized write access TK-43A6EE72	1.00	CRITICAL (10.0)	D3F	CAPEC-153: Input Data Manipulation CAPEC-168: Windows ::DATA Alternate Data Stream CAPEC-201: Serialized Data External Linking CAPEC-221: Data Serialization External Entities Blowup CAPEC-274: HTTP Verb Tampering CAPEC-277: Data Interchange Protocol Manipulation CAPEC-443: Malicious Logic Inserted Into Product by Authorized Developer CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-446: Malicious Logic Insertion into Product via Inclusion of Third-Party Component CAPEC-520: Counterfeit Hardware Component Inserted During Product Assembly	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	—
9	Product Database	N/A	pytm	SQL injection vulnerability on Product Database allowing command execution or data manipulation TK-EC17C6C8	1.00	CRITICAL (10.0)	D3F	CAPEC-153: Input Data Manipulation CAPEC-277: Data Interchange Protocol Manipulation CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-113: Interface Manipulation CAPEC-123: Buffer Manipulation CAPEC-124: Shared Resource Manipulation CAPEC-129: Pointer Manipulation CAPEC-14: Client-side Injection-induced Buffer Overflow CAPEC-161: Infrastructure Manipulation CAPEC-165: File Manipulation	T1195: Supply Chain Compromise T1036: Masquerading	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1047: Audit M1018: User Account Management M1017: User Training M1045: Code Signing M1040: Behavior Prevention on Endpoint M1022: Restrict File and Directory Permissions M1049: Antivirus/Antimalware M1038: Execution Prevention	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SFA: System File Analysis Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. D3-DLIC: Driver Load Integrity Checking Ensuring the integrity of drivers loaded during initialization of the operating system. D3-SBV: Service Binary Verification Analyzing changes in service binary files by comparing to a source of truth. D3-ANET: Authentication Event Thresholding Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile. D3-AZET: Authorization Event Thresholding Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile. D3-JFAPA: Job Function Access Pattern Analysis Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department. D3-RAPA: Resource Access Pattern Analysis Analyzing the resources accessed by a user to identify unauthorized activity. D3-SDA: Session Duration Analysis Analyzing the duration of user sessions in order to detect unauthorized activity. D3-UDTA: User Data Transfer Analysis Analyzing the amount of data transferred by a user. D3-UGLPA: User Geolocation Logon Pattern Analysis Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. D3-WSAA: Web Session Activity Analysis Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior. D3-FCR: File Content Rules Employing a pattern matching rule language to analyze the content of files. D3-FH: File Hashing Employing file hash comparisons to detect known malware. D3-PA: Process Analysis Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations. D3-PSEP: Process Segment Execution Prevention Preventing execution of any address in a memory region other than the code segment.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 2.5: Allowlist Authorized Software CIS 2.7: Allowlist Authorized Scripts CIS 3.3: Configure Data Access Control Lists CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.8: Define and Maintain Role-Based Access Control	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Account Management Access Enforcement Least Privilege Continuous Monitoring Baseline Configuration Configuration Settings Least Functionality Service Identification and Authentication Information Input Validation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
10	CI/CD Server	N/A	pytm	Unpatched OS or software vulnerabilities on CI/CD Server leading to system compromise TK-9E927052	1.00	CRITICAL (10.0)	D3F	CAPEC-677: Server Motherboard Compromise CAPEC-166: Force the System to Reset Values CAPEC-184: Software Integrity Attack CAPEC-185: Malicious Software Download CAPEC-186: Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection CAPEC-220: Client-Server Protocol Manipulation CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-442: Infected Software CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation	T1195: Supply Chain Compromise T1072: Software Deployment Tools	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation M1018: User Account Management M1015: Active Directory Configuration M1051: Update Software M1026: Privileged Account Management M1027: Password Policies M1033: Limit Software Installation M1030: Network Segmentation M1017: User Training M1032: Multi-factor Authentication M1029: Remote Data Storage	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules. D3-ANCI: Authentication Cache Invalidation Removing tokens or credentials from an authentication cache to prevent further user associated account accesses. D3-DTP: Domain Trust Policy Restricting inter-domain trust by modifying domain configuration. D3-UAP: User Account Permissions Restricting a user account's access to resources. D3-DAM: Domain Account Monitoring Monitoring the existence of or changes to Domain User Accounts. D3-LAM: Local Account Monitoring Analyzing local user accounts to detect unauthorized activity. D3-SPP: Strong Password Policy Modifying system configuration to increase password strength. D3-OTP: One-time Password A one-time password is valid for only one user authentication. D3-BDI: Broadcast Domain Isolation Broadcast isolation restricts the number of computers a host can contact on their LAN. D3-ET: Encrypted Tunnels Encrypted encapsulation of routable network traffic. D3-ISVA: Inbound Session Volume Analysis Analyzing inbound network session or connection attempt volume. D3-ITF: Inbound Traffic Filtering Restricting network traffic originating from untrusted networks destined towards a private host or enclave. D3-MFA: Multi-factor Authentication Requiring proof of two or more pieces of evidence in order to authenticate a user.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests CIS 3.12: Segment Data Processing and Storage Based on Sensitivity CIS 4.1: Establish and Maintain a Secure Configuration Process CIS 4.4: Implement and Manage a Firewall on Servers CIS 4.7: Manage Default Accounts on Enterprise Assets and Software CIS 5.1: Establish and Maintain an Inventory of Accounts CIS 5.2: Use Unique Passwords CIS 5.3: Disable Dormant Accounts CIS 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts CIS 5.5: Establish and Maintain an Inventory of Service Accounts CIS 6.1: Establish an Access Granting Process CIS 6.2: Establish an Access Revoking Process CIS 6.4: Require MFA for Remote Network Access CIS 6.5: Require MFA for Administrative Access CIS 6.8: Define and Maintain Role-Based Access Control CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 12.2: Establish and Maintain a Secure Network Architecture CIS 12.8: Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS 14.9: Conduct Role-Specific Security Awareness and Skills Training CIS 15.7: Securely Decommission Service Providers CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.8: Separate Production and Non-Production Systems CIS 16.9: Train Developers in Application Security Concepts and Secure Coding CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation Session Termination Account Management Use of External Systems Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Continuous Monitoring Baseline Configuration Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Identification and Authentication (organizational Users) Authenticator Management Cryptographic Key Establishment and Management Public Key Infrastructure Certificates Cross Domain Policy Enforcement Boundary Protection Flaw Remediation Information Fragmentation Malicious Code Protection System Monitoring Software, Firmware, and Information Integrity	No specific OWASP mitigations found.	—
11	Product Microservice	N/A	AI	(AI) Unvalidated API Input Enables Business Logic Manipulation and Data Corruption: The Product Microservice receives API requests via HTTPS from the API Gateway, authenticated by token. However, if input validation is insufficient, an attacker can manipulate parameters to alter product pricing, inventory counts, or order data, corrupting business state without necessarily bypassing authentication. TK-C578922E	0.90	CRITICAL (10.0)	D3F	CAPEC-611: BitSquatting CAPEC-612: WiFi MAC Address Tracking CAPEC-153: Input Data Manipulation CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-277: Data Interchange Protocol Manipulation CAPEC-443: Malicious Logic Inserted Into Product by Authorized Developer CAPEC-446: Malicious Logic Insertion into Product via Inclusion of Third-Party Component CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-71: Using Unicode Encoding to Bypass Validation Logic CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic CAPEC-113: Interface Manipulation CAPEC-123: Buffer Manipulation	T1195: Supply Chain Compromise	M1046: Boot Integrity M1013: Application Developer Guidance M1051: Update Software M1018: User Account Management M1016: Vulnerability Scanning M1033: Limit Software Installation	D3-BA: Bootloader Authentication Cryptographically authenticating the bootloader software before system boot. D3-TBI: TPM Boot Integrity Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM). D3-SU: Software Update Replacing old software on a computer system component. D3-LFP: Local File Permissions Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. D3-SCF: System Call Filtering Controlling access to local computer system resources with kernel-level capabilities. D3-SCP: System Configuration Permissions Restricting system configuration modifications to a specific user or group of users. D3-EAL: Executable Allowlisting Using a digital signature to authenticate a file before opening. D3-EDL: Executable Denylisting Blocking the execution of files on a host in accordance with defined application policy rules.	CIS 7.1: Establish and Maintain a Vulnerability Management Process CIS 7.2: Establish and Maintain a Remediation Process CIS 7.3: Perform Automated Operating System Patch Management CIS 7.4: Perform Automated Application Patch Management CIS 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS 16.1: Establish and Maintain a Secure Application Development Process CIS 16.2: Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS 16.3: Perform Root Cause Analysis on Security Vulnerabilities CIS 16.4: Establish and Manage an Inventory of Third-Party Software Components CIS 16.5: Use Up-to-Date and Trusted Third-Party Software Components CIS 16.11: Leverage Vetted Modules or Services for Application Security Components CIS 16.12: Implement Code-Level Security Checks CIS 18.3: Remediate Penetration Test Findings CIS 18.5: Perform Periodic Internal Penetration Tests	Control Assessments Continuous Monitoring User-installed Software Least Functionality Threat Hunting Vulnerability Monitoring and Scanning Unsupported System Components Flaw Remediation	No specific OWASP mitigations found.	🔍 MEDIUM Missing logs (3) API Gateway request validation logs — input validation failures and sanitization events Product Microservice application logs — parameter validation errors and business logic exception events WAF logs — SQL injection, XSS, and command injection detection patterns SIEM rules (3) Product Microservice business logic anomalies — price or inventory parameter manipulation `event_type=api_request AND dest_service=product_microservice AND (query_param price=0 OR query_param inventory > 10000) AND NOT user_role in [admin, auditor]` Product Microservice input validation failures — malformed payload detected `event_type=api_request AND dest_service=product_microservice AND (http_status=400 OR http_status=422) AND NOT validation_rule_matched` API requests with unexpected parameter types or ranges `event_type=api_request AND dest_service=product_microservice AND (is_numeric(price) AND price < 0) OR (is_inventory(inventory) AND inventory < 0)` IOCs (3) Crafted API payloads with price set to 0 or negative values Inventory parameters inflated beyond expected business ranges Parameter pollution techniques: duplicate headers, mixed case parameter names

🛡️ STRIDE & MITRE ATT&CK Threat Model Report

📊 Threat Statistics

🎯 MITRE Techniques

🛡️ STRIDE Distribution

📋 Executive Summary

🔥 Top 5 Threats by Severity

🎯 Risk Matrix

🎯 CISO Risk Briefing

Top Findings

Quick Wins

🕸️ Threat Graph

⛓️ Attack Chain Analysis

🔍 Detailed Threat Analysis