🛡️ STRIDE & MITRE ATT&CK Threat Model Report

Cybersecurity Threat Analysis Report

📊 Threat Statistics

  • Total Threats 253
  • Average Severity 8.61
  • Max Severity 10.00
  • Min Severity 5.10
  • Severity Distribution
    CRITICAL 128
    HIGH 68
    MEDIUM 54
    LOW 3

🎯 MITRE Techniques

33

Techniques Mapped

🛡️ STRIDE Distribution

  • Spoofing 52
  • Denial of Service 19
  • Tampering 29
  • Information Disclosure 77
  • Elevation of Privilege 47
  • Repudiation 29

📋 Executive Summary

10.0
Max Risk Score
8.6
Avg Risk Score
128
Critical Threats
68
High Threats
253
Total Threats

🔥 Top 5 Threats by Severity

# Target STRIDE Severity Description
1 Web Application Firewall Spoofing CRITICAL (10.0) Firewall rule misconfiguration allowing unintended traffic to bypass Web Application Firewall and reach internal networks
2 ot scada zone Denial of Service CRITICAL (10.0) (AI) OT SCADA Zone Process Disruption via Network Attack: The OT SCADA Zone has no network-level protections (WAF, IDS, IPS)...
3 Edge Router Tampering CRITICAL (10.0) Unpatched OS or software vulnerabilities on Edge Router leading to system compromise
4 Web Application Firewall Tampering CRITICAL (10.0) Unpatched OS or software vulnerabilities on Web Application Firewall leading to system compromise
5 Reverse Proxy Tampering CRITICAL (10.0) Unpatched OS or software vulnerabilities on Reverse Proxy leading to system compromise

🎯 Risk Matrix

Threats plotted by Impact (Y-axis, derived from severity score) vs Likelihood (X-axis, derived from risk signals: CVE + CWE + network exposure). Hover over a dot for details.

Impact ↑
← Likelihood →
Critical High Medium Low
📋 Model Completeness D · 41% ▶
D
41%

A higher completeness score improves threat detection accuracy, AI enrichment quality, and severity scoring.

Check Score Wt Hint
Dataflows authenticated 0% (0/31) 15 Add is_authenticated=true to dataflows that require credentials or token-based auth to reduce false positives in threat scoring.
Dataflows encrypted 29% (9/31) 15 Add is_encrypted=true to dataflows that use TLS/SSH/IPSec. Unencrypted flows receive higher STRIDE scores.
Dataflows have protocol 100% (31/31) 10
Boundaries trust defined 100% (9/9) 15
Boundaries described 0% (0/9) 5 Add a description to boundaries (e.g. 'DMZ — internet-facing zone'). Descriptions improve AI prompt quality.
Servers have classification 0% (0/22) 15 Set classification= (PUBLIC/INTERNAL/RESTRICTED/SECRET) on servers. Classification affects severity scoring.
Servers described 0% (0/22) 5 Add description= to servers. Descriptions are used in AI prompts and improve threat specificity.
Actors described 0% (0/7) 5 Add description= to actors. Descriptions help the AI identify privilege levels and attack surfaces.
Model defines at least one boundary ✓ 5
Model defines at least one dataflow ✓ 5

🎯 CISO Risk Briefing

9.4
/ 10
CRITICAL

The organisation faces a CRITICAL security posture with unpatched core infrastructure enabling system compromise and credential exposure across identity flows. The Red/Blue debate confirmed that financially motivated attack scenarios for financial data exfiltration remain viable after Blue's defences, indicating active exploitation risk. High-severity denial of service threats to OT SCADA and IT zones, combined with firewall misconfigurations, create immediate paths for disruption and unauthorized access. Prioritising emergency patching, network segmentation, and encrypted credential transmission is essential to reducing existential risk.

Top Findings

  1. Unpatched Core Infrastructure Enabling System Compromise T-0005, T-0006, T-0007, T-0008, T-0009, T-0010, T-0011 ⚡ GDAF-1D6A86E1, GDAF-8E01A940, GDAF-A60D8259, GDAF-6105523A, GDAF-3B8FB173, GDAF-91E7498A, GDAF-B8685518, GDAF-DFDEA639, GDAF-0DE747D6, GDAF-4684E1B7
    Critical and high-severity tampering threats target edge routers, firewalls, and proxies with unpatched OS vulnerabilities, creating direct paths for external actors and remote employees to inject malicious data. The Red/Blue debate confirmed these scenarios remain viable after Blue's defences, indicating active exploitation risk. Compromise of these assets could lead to full network penetration, data exfiltration, and OT/IT disruption.
  2. Credential Exposure Across Identity and Data Flows T-0012, T-0013, T-0014, T-0015, T-0016, T-0017, T-0018, T-0019, T-0020 ⚡ GDAF-1D6A86E1, GDAF-8E01A940, GDAF-A60D8259, GDAF-6105523A, GDAF-3B8FB173, GDAF-91E7498A, GDAF-B8685518, GDAF-DFDEA639, GDAF-0DE747D6, GDAF-4684E1B7
    Critical information disclosure threats involve unencrypted credential transmission from employee workstations, jump servers, and finance personnel to domain controllers, ERP systems, and databases. The Red/Blue debate confirmed these credential exfiltration paths are still viable, enabling lateral movement and privilege escalation. This directly fuels financial data exfiltration objectives observed in the GDAF scenarios.
  3. Denial of Service Impacting Critical Zones T-0001, T-0002, T-0003, T-0004
    High-severity denial of service threats target the OT SCADA zone, DMZ, and IT infrastructure zone with volumetric and ransomware-style attacks. Without adequate IPS or redundancy, these attacks could disrupt operational technology processes or encrypt critical IT infrastructure. The business impact includes prolonged downtime, safety risks in OT environments, and significant financial loss from IT outages.
  4. Spoofing and Identity Bypass via Firewall Misconfiguration T-0001
    Critical spoofing threat involves firewall rule misconfiguration allowing unintended traffic to bypass web application protections. This creates an attack surface for external actors to spoof identities and gain unauthorized access. The combination of misconfigured perimeter controls and unpatched infrastructure amplifies the risk of successful identity-based attacks.
  5. Repudiation Risks in Distributed Systems T-0021, T-0022, T-0023, T-0024, T-0025, T-0026, T-0027, T-0028, T-0029, T-0030, T-0031, T-0032, T-0033, T-0034, T-0035, T-0036, T-0037, T-0038, T-0039, T-0040, T-0041, T-0042, T-0043, T-0044, T-0045, T-0046, T-0047, T-0048, T-0049, T-0050
    Repudiation threats relate to the 29 identified risks in the environment, enabling actors to perform actions without accountability. While individually scored lower, the aggregate volume and the potential for coordinated attacks across multiple vectors present a sustained risk to audit integrity and forensic investigation capabilities.

Quick Wins

Action Impact Effort Addresses
Deploy network segmentation and micro-segmentation to isolate OT SCADA and IT infrastructure zones, limiting lateral movement from DMZ attacks. HIGH MEDIUM T-0001, T-0002, T-0003, T-0004
Apply emergency patching cycle for all edge routers, firewalls, web application firewalls, reverse proxies, and mail gateways to eliminate critical unpatched vulnerability paths. HIGH HIGH T-0005, T-0006, T-0007, T-0008, T-0009, T-0010, T-0011
Enforce encrypted credential transmission and zero-trust access controls for all employee-to-AD, ERP, and database data flows to prevent information disclosure. HIGH MEDIUM T-0012, T-0013, T-0014, T-0015, T-0016, T-0017, T-0018, T-0019, T-0020
Review and remediate firewall rule sets to block unintended traffic bypass and enforce strict spoofing protections at the perimeter. HIGH MEDIUM T-0001
Implement logging and anomaly detection for repudiation vectors to improve forensic capability and accountability across distributed systems. MEDIUM LOW T-0021, T-0022, T-0023, T-0024, T-0025, T-0026, T-0027, T-0028, T-0029, T-0030, T-0031, T-0032, T-0033, T-0034, T-0035, T-0036, T-0037, T-0038, T-0039, T-0040, T-0041, T-0042, T-0043, T-0044, T-0045, T-0046, T-0047, T-0048, T-0049, T-0050

🕸️ Threat Graph

Interactive attack-surface map. Click a node to list its threats. Node colour = highest severity. Edge style: solid = encrypted, dashed = plain.

Click a node to see its threats.
CRITICAL HIGH MEDIUM LOW No threats ⬡ Server   ○ Actor

⛓️ Attack Chain Analysis

Each row represents a potential pivot chain: an attacker compromises the Entry Point component via its highest-severity threat, then traverses the dataflow to exploit the Target component. Chains are ranked by average severity. Showing top 10 of 31 chains.

# Chain Score Entry Point Dataflow / Protocol Target Entry Threat Pivot Threat
1 CRITICAL (10.0) External Attacker ExternalToRouter
TCP 		Edge Router
Tampering
Untrusted actor External Attacker may attempt to inject malicious data or exploit...
Tampering
Unpatched OS or software vulnerabilities on Edge Router leading to system compromise
2 CRITICAL (10.0) Remote Employee RemoteToVPN
IPSEC 		Corporate VPN Gateway
Tampering
Untrusted actor Remote Employee may attempt to inject malicious data or exploit vulnerabilities...
Tampering
Unpatched OS or software vulnerabilities on Corporate VPN Gateway leading to system compromise
3 CRITICAL (10.0) External Attacker ExternalToMail
SMTP 		Mail Gateway
Tampering
Untrusted actor External Attacker may attempt to inject malicious data or exploit...
Tampering
Unpatched OS or software vulnerabilities on Mail Gateway leading to system compromise
4 CRITICAL (10.0) Edge Router RouterToWAF
HTTP 		Web Application Firewall
Tampering
Unpatched OS or software vulnerabilities on Edge Router leading to system compromise
Spoofing
Firewall rule misconfiguration allowing unintended traffic to bypass Web Application Firewall...
5 CRITICAL (10.0) Web Application Firewall WAFToProxy
HTTP 		Reverse Proxy
Spoofing
Firewall rule misconfiguration allowing unintended traffic to bypass Web Application Firewall...
Tampering
Unpatched OS or software vulnerabilities on Reverse Proxy leading to system compromise
6 CRITICAL (10.0) Reverse Proxy ProxyToInternalFW
HTTP 		Internal Firewall
Tampering
Unpatched OS or software vulnerabilities on Reverse Proxy leading to system compromise
Tampering
Unpatched OS or software vulnerabilities on Internal Firewall leading to system compromise
7 CRITICAL (10.0) Mail Gateway MailToWorkstation
SMTP 		Employee Workstation
Tampering
Unpatched OS or software vulnerabilities on Mail Gateway leading to system compromise
Tampering
Unpatched OS or software vulnerabilities on Employee Workstation leading to system compromise
8 CRITICAL (10.0) Corporate VPN Gateway VPNToInternalFW
IPSEC 		Internal Firewall
Tampering
Unpatched OS or software vulnerabilities on Corporate VPN Gateway leading to system compromise
Tampering
Unpatched OS or software vulnerabilities on Internal Firewall leading to system compromise
9 CRITICAL (10.0) Internal Firewall InternalFWToWorkstation
TCP 		Employee Workstation
Tampering
Unpatched OS or software vulnerabilities on Internal Firewall leading to system compromise
Tampering
Unpatched OS or software vulnerabilities on Employee Workstation leading to system compromise
10 CRITICAL (10.0) Employee Workstation WorkstationToAD
LDAP 		Primary Domain Controller
Tampering
Unpatched OS or software vulnerabilities on Employee Workstation leading to system compromise
Tampering
Unpatched OS or software vulnerabilities on Primary Domain Controller leading to system compromise
⚡ GDAF Attack Scenarios 10 Goal-Driven Attack Flows — click to expand

Objective-based attack paths computed by the Goal-Driven Attack Flow engine. Each scenario models a complete adversary journey from entry point to high-value target, with MITRE ATT&CK techniques assigned per hop. Sorted by path score (highest risk first).

# Risk Objective Actor Attack Path Score Hops Detection
1
GDAF-1D6A86E1
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Financially Motivated Cybercriminal Group
medium
 Mail Gateway → Employee Workstation → Primary Domain Controller → Jump Server → Financial ERP System 6.22 5 50%
2
GDAF-8E01A940
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Financially Motivated Cybercriminal Group
medium
 Edge Router → Web Application Firewall → Reverse Proxy → Internal Firewall → Employee Workstation → Primary Domain Controller → Jump Server → Financial ERP System 6.02 8 46%
3
GDAF-A60D8259
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Financially Motivated Cybercriminal Group
medium
 Mail Gateway → Employee Workstation → SIEM Server → Primary Domain Controller → Jump Server → Financial ERP System 6.0 6 55%
4
GDAF-6105523A
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Financially Motivated Cybercriminal Group
medium
 Mail Gateway → Employee Workstation → Primary Domain Controller → Jump Server → Financial ERP System → Core Database Cluster 6.09 6 45%
5
GDAF-3B8FB173
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Financially Motivated Cybercriminal Group
medium
 Mail Gateway → Employee Workstation → SIEM Server → Primary Domain Controller → Jump Server → Financial ERP System → Core Database Cluster 5.92 7 50%
6
GDAF-91E7498A
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Financially Motivated Cybercriminal Group
medium
 Corporate VPN Gateway → Internal Firewall → Employee Workstation → Primary Domain Controller → Jump Server → Financial ERP System → Core Database Cluster 5.88 7 50%
7
GDAF-B8685518
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Malicious Insider
low
 Financial ERP System 5.75 1 20%
8
GDAF-DFDEA639
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Malicious Insider
low
 Employee Workstation → Primary Domain Controller → Jump Server → Financial ERP System 5.36 4 50%
9
GDAF-0DE747D6
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Malicious Insider
low
 Employee Workstation → SIEM Server → Primary Domain Controller → Jump Server → Financial ERP System 5.26 5 56%
10
GDAF-4684E1B7
 CRITICAL
Financial Data Exfiltration
Steal financial records, SAP data, and transaction history
Malicious Insider
low
 Financial ERP System → Core Database Cluster 5.55 2 20%
🔍 Automatically Discovered Attack Paths 3 Found from the threat data itself, no GDAF context needed — click to expand

Unlike GDAF (analyst-defined objectives and actors), these paths are found automatically by following each threat's MITRE ATT&CK tactic progression through the architecture. Best (highest-severity) path shown per STRIDE category.

# STRIDE Category Attack Path Score Hops Threats
1 Elevation of Privilege Edge Router → Edge Router → External Attacker → EmployeeToWorkstation → Web Application Firewall → EmployeeToWorkstation → EmployeeToWorkstation → vpn perimeter 80.0
Edge Router
T1195 — Supply Chain Compromise (Initial Access)
Edge Router
T1072 — Software Deployment Tools (Execution)
External Attacker
T1221 — Template Injection (Defense Evasion)
EmployeeToWorkstation
T1056 — Input Capture (Collection)
Web Application Firewall
T1072 — Software Deployment Tools (Execution)
EmployeeToWorkstation
T1005 — Data from Local System (Collection)
EmployeeToWorkstation
T1052 — Exfiltration Over Physical Medium (Exfiltration)
vpn perimeter
T1498 — Network Denial of Service (Impact)
 T-0005, T-0005, T-0010, T-0012, T-0006, T-0012, T-0012, T-0068
Narrative: An attacker begins by compromising the Edge Router through a supply chain compromise, leveraging unpatched OS or software vulnerabilities to gain initial access. Using software deployment tools for execution, they pivot to an external attacker position, where template injection is employed to evade defenses. The path then moves to an employee workstation via input capture, collecting credentials transmitted over unencrypted channels. From the web application firewall, the attacker again uses software deployment tools to execute code, before exfiltrating data from the local system over a physical medium. The attack culminates at the VPN perimeter, where network denial of service impacts availability, exploiting the lack of authentication controls to enable credential theft and reuse for unauthorized access.
Business impact: Successful exploitation results in full system compromise of the Edge Router and employee workstations, unauthorized access to the VPN, and potential data exfiltration. The attacker can bypass authentication, steal credentials, disrupt network availability, and pivot laterally across the organization, leading to significant operational disruption, data loss, and reputational damage.
2 Information Disclosure Edge Router → Edge Router → External Attacker → EmployeeToWorkstation → Web Application Firewall → EmployeeToWorkstation → EmployeeToWorkstation → vpn perimeter 80.0
Edge Router
T1195 — Supply Chain Compromise (Initial Access)
Edge Router
T1072 — Software Deployment Tools (Execution)
External Attacker
T1221 — Template Injection (Defense Evasion)
EmployeeToWorkstation
T1056 — Input Capture (Collection)
Web Application Firewall
T1072 — Software Deployment Tools (Execution)
EmployeeToWorkstation
T1005 — Data from Local System (Collection)
EmployeeToWorkstation
T1052 — Exfiltration Over Physical Medium (Exfiltration)
vpn perimeter
T1498 — Network Denial of Service (Impact)
 T-0005, T-0005, T-0010, T-0012, T-0006, T-0012, T-0012, T-0068
Narrative: An attacker begins by compromising the Edge Router through a supply chain attack, leveraging unpatched software to gain initial access. Using software deployment tools, they execute code on the router and pivot to an external foothold. From there, a template injection technique allows defense evasion as malicious data flows into the corporate environment. Credentials and data are captured from the employee-to-workstation channel via input capture, exploiting unencrypted communications. The attacker then harvests local system data and exfiltrates sensitive information over the physical medium. Finally, a network denial-of-service attack targets the VPN perimeter, exploiting the lack of authentication controls to facilitate credential theft and reuse for unauthorized access.
Business impact: Successful exploitation leads to full credential compromise and unauthorized network access, enabling data theft, lateral movement, and operational disruption. The combination of information disclosure and service availability loss threatens sensitive corporate assets, customer trust, and regulatory compliance.
3 Tampering Edge Router → Edge Router → External Attacker → EmployeeToWorkstation → Web Application Firewall → EmployeeToWorkstation → EmployeeToWorkstation → vpn perimeter 80.0
Edge Router
T1195 — Supply Chain Compromise (Initial Access)
Edge Router
T1072 — Software Deployment Tools (Execution)
External Attacker
T1221 — Template Injection (Defense Evasion)
EmployeeToWorkstation
T1056 — Input Capture (Collection)
Web Application Firewall
T1072 — Software Deployment Tools (Execution)
EmployeeToWorkstation
T1005 — Data from Local System (Collection)
EmployeeToWorkstation
T1052 — Exfiltration Over Physical Medium (Exfiltration)
vpn perimeter
T1498 — Network Denial of Service (Impact)
 T-0005, T-0005, T-0010, T-0012, T-0006, T-0012, T-0012, T-0068
Narrative: An attacker begins by compromising the Edge Router through a supply chain compromise, leveraging unpatched OS or software vulnerabilities to gain initial access. Using software deployment tools for execution, they pivot to an External Attacker position where template injection enables defense evasion. The path then moves to an Employee Workstation via input capture, collecting credentials transmitted over unencrypted channels. From there, the attacker exploits the Web Application Firewall through its own software deployment tools, before moving laterally to a second Employee Workstation to harvest data from the local system. Finally, exfiltration over the physical medium allows the extraction of sensitive credentials, culminating in a denial of service attack against the VPN perimeter, which lacks authentication controls and is vulnerable to credential theft and reuse.
Business impact: Successful exploitation results in full credential compromise of corporate employees, unauthorized access to the VPN, and potential disruption of network availability. The attacker can pivot from the Edge Router through workstations to exfiltrate sensitive data, while the unprotected VPN perimeter enables unauthorized access to internal resources, causing significant operational and reputational damage.
🥊 Adversarial Review 5 Red (attack) vs. Blue (defence) challenge on top attack paths — click to expand

Each top attack path below was challenged in a multi-round Red (attack) vs. Blue (defence) exchange. Read it for what Blue blocked, where detection gaps remain, and what Red tried and failed. The verdict is a qualitative outcome — the numeric score adjustment it drives is directional, not precise (see docs/evaluation.md).

RESIDUAL PATH VIABLE ⚡ GDAF-3A64A627 Full Domain Compromise External Attacker → Backup Domain Controller

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked
  • T1078
  • T1078
🕳️ Detection gaps on the residual path
StepControl familyCoveredDetailConfidence
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
T1190 via SMTP Mail Gateway IDS ❌ No IDS signature for unauthenticated unencrypted SMTP spearphishing link delivery medium
🚫 Red's failed alternative attempts
  • Attempted T1003.001 via LDAP — blocked by Blue's prior response blocking T1003.001 on unauthenticated LDAP
2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)
📜 Full debate transcript
Round 1 · RED · viability estimate 0.75
Mail Gateway accepts unauthenticated SMTP; T1190 (SMTP smuggling) and T1078 (valid account) provide initial foothold. From there, T1078 to Employee Workstation, then lateral via T1003.001 to Primary Domain Controller, and finally T1003.006 to Backup Domain Controller.
  • Mail Gateway SMTP unauthenticated and unencrypted — protocol_config: Mail Gateway [entry]: protocol=smtp, unauthenticated, unencrypted (high)
  • T1190 SMTP smuggling feasible on unauthenticated channel — candidate_technique: Mail Gateway [entry]: candidate techniques: T1566, T1078, T1190 (high)
  • Employee Workstation reachable via SMTP from Mail Gateway — protocol_config: Employee Workstation [intermediate]: protocol=smtp, unauthenticated, unencrypted (high)
  • T1003.001 LDAP/ RPC lateral movement to Domain Controllers — candidate_technique: Primary Domain Controller [intermediate]: candidate techniques: T1003.001, T1003.006, T1558.001; Backup Domain Controller [target]: candidate techniques: T1003.001, T1003.006, T1558.001 (high)
Round 1 · BLUE · viability estimate 0.50
Mail Gateway SMTP unauthenticated allows T1190 and T1078 initial foothold; EDR blocks credential reuse on Employee Workstation; lateral movement to Primary and Backup Domain Controllers via T1003.001 and T1003.006 proceeds with partial detection due to missing SIEM correlation for unauthenticated SSH.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)
Round 2 · RED · viability estimate 0.50
T1190 (Spearphishing Link) via the Mail Gateway is viable as Blue only blocked T1078; the gateway is unauthenticated and unencrypted SMTP with known CVE-2020-4788. T1078 is blocked on the Employee Workstation but may still deliver the initial payload. Once on the workstation, T1003.001 lateral movement to the Primary Domain Controller via LDAP is blocked per Blue's response, so the path redirects to the Backup Domain Controller via RPC, where T1003.001 and T1558.001 are candidate techniques with known CVEs.
  • Mail Gateway SMTP unauthenticated allows initial foothold via T1190 — protocol_config: Mail Gateway [entry]: protocol=smtp, unauthenticated, unencrypted, candidate techniques: T1566, T1078, T1190; known CVEs: CVE-2020-4788 (high)
  • T1078 blocked on Employee Workstation EDR — privilege_boundary: Employee Workstation [intermediate]: protocol=smtp, unauthenticated, unencrypted, candidate techniques: T1003.001, T1078, T1566.001; known CVEs: CVE-2022-30190, CVE-2021-34527; Blue blocked T1078: EDR blocks credential reuse (high)
  • Lateral movement to Backup Domain Controller via RPC with T1003.001 and T1558.001 — protocol_config: Backup Domain Controller [target]: protocol=rpc, unauthenticated, unencrypted, candidate techniques: T1003.001, T1003.006, T1558.001; known CVEs: CVE-2020-1472, CVE-2021-42278, CVE-2021-42287 (high)
Round 2 · BLUE · viability estimate 0.50
T1078 is blocked on the Employee Workstation per grounding facts. T1190 via SMTP is not detected because the Mail Gateway is unauthenticated and unencrypted with no IDS signature listed for this vector. LDAP lateral movement to the Primary Domain Controller is blocked, redirecting to the Backup Domain Controller via RPC where T1003.001 and T1558.001 remain viable.
  • EDR blocks known T1078 credential reuse pattern on Employee Workstation — privilege_boundary: Employee Workstation protocol=smtp unauthenticated unencrypted candidate techniques include T1078 (high)
RESIDUAL PATH VIABLE ⚡ GDAF-57816302 Full Domain Compromise External Attacker → Backup Domain Controller

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked
  • T1078
  • T1190
🕳️ Detection gaps on the residual path
StepControl familyCoveredDetailConfidence
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
🚫 Red's failed alternative attempts
  • Attempted T1110 password spraying — blocked by account lockout policy
2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)
📜 Full debate transcript
Round 1 · RED · viability estimate 0.75
Leveraging SMTP unauthenticated relay from Mail Gateway to deliver malicious payloads that execute on the Employee Workstation, then pivoting through SMB/AD to the Backup Domain Controller.
  • SMTP unauthenticated relay allows injection of malicious attachments — protocol_config: Mail Gateway [entry]: protocol=smtp, unauthenticated, unencrypted, candidate techniques: T1566, T1078, T1190 (high)
  • Employee Workstation executes delivered payload via T1190 — technique_execution: Employee Workstation [intermediate]: protocol=smtp, candidate techniques: T1190, T1078, T1566.001 (high)
  • SMB lateral movement from Workstation to Primary Domain Controller — protocol_transport: Primary Domain Controller [intermediate]: protocol=ldap, candidate techniques: T1003.001, T1003.006, T1558.001 (high)
  • AD replication over RPC to Backup Domain Controller — protocol_transport: Backup Domain Controller [target]: protocol=rpc, candidate techniques: T1003.001, T1003.006, T1558.001 (high)
Round 1 · BLUE · viability estimate 0.50
SMTP unauthenticated relay (T1190) is blocked at the Mail Gateway protocol boundary; T1078 credential reuse is blocked by EDR privilege boundary with MFA enforcement.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)
Round 2 · RED · viability estimate 0.75
T1190 SMTP unauthenticated relay is blocked at the Mail Gateway protocol boundary per Blue's response, but T1078 credential reuse via SMB relay to the Backup Domain Controller succeeds over the unauthenticated RPC channel; the RPC protocol lacks encryption and authentication, allowing SMB relay that bypasses the MFA-protected EDR boundary on the PDC.
  • SMB relay to Backup Domain Controller via unauthenticated RPC channel — protocol_boundary: Backup Domain Controller [target]: protocol=rpc, unauthenticated, unencrypted, known CVEs: CVE-2020-1472, CVE-2021-42278, CVE-2021-42287 (high)
Round 2 · BLUE · viability estimate 0.50
T1190 is blocked at the Mail Gateway protocol boundary as unauthenticated SMTP relay is not permitted. T1078 is blocked on the Primary Domain Controller via EDR credential reuse detection, but the SMB relay to the Backup Domain Controller succeeds over the unauthenticated RPC channel, leaving that path viable.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)
RESIDUAL PATH VIABLE ⚡ GDAF-D1FC022E Full Domain Compromise External Attacker → Primary Domain Controller

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked
  • T1078
  • T1078
🕳️ Detection gaps on the residual path
StepControl familyCoveredDetailConfidence
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
🚫 Red's failed alternative attempts
  • Attempted T1110 password spraying — blocked by account lockout policy
2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)
📜 Full debate transcript
Round 1 · RED · viability estimate 0.75
Leveraging the unauthenticated, unencrypted SMTP gateway to deliver malicious payloads via T1190 (User Execution) and T1078 (Valid Accounts) to the Employee Workstation, followed by lateral movement to the Primary Domain Controller.
  • SMTP gateway accepts unauthenticated, unencrypted traffic enabling T1190 delivery — protocol_config: Mail Gateway dataflow: protocol=smtp, unauthenticated=true, unencrypted=true (high)
  • T1190 User Execution via malicious attachment delivered through SMTP — technique: Mail Gateway candidate techniques: T1190 (high)
  • T1078 Valid Accounts credential harvesting or reuse via SMTP-facilitated phishing — technique: Mail Gateway candidate techniques: T1078 (high)
  • Employee Workstation reachable via SMTP and susceptible to initial access — protocol_config: Employee Workstation dataflow: protocol=smtp, unauthenticated=true, unencrypted=true (high)
Round 1 · BLUE · viability estimate 0.50
T1190 is blocked at the Mail Gateway via attachment scanning; T1078 is blocked at the Employee Workstation via EDR credential reuse detection with MFA enforcement.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)
Round 2 · RED · viability estimate 0.75
T1190 (Fileless Delivery) via the unencrypted SMTP mail gateway delivers payload to the Employee Workstation; T1078 (Valid Accounts) leverages the workstation compromise to pivot toward the Domain Controller. Blue has blocked T1078 at the workstation via EDR credential reuse detection with MFA enforcement, but the initial T1190 delivery remains viable.
  • SMTP mail gateway accepts unauthenticated, unencrypted inbound mail with attachment — protocol: Mail Gateway dataflow: protocol=smtp, unauthenticated=true, unencrypted=true (high)
  • Employee Workstation receives and executes T1190-delivered payload — protocol: Employee Workstation dataflow: protocol=smtp, unauthenticated=true, unencrypted=true, candidate techniques: T1190 (high)
  • T1078 credential reuse from compromised workstation to Domain Controller is blocked by Blue EDR — misconfig: Blue blocked: T1078. Rationale: T1190 is blocked at the Mail Gateway via attachment scanning; T1078 is blocked at the Employee Workstation via EDR credential reuse detection with MFA enforcement. (high)
Round 2 · BLUE · viability estimate 0.50
T1190 delivery via unencrypted SMTP to the workstation is not blocked by existing controls; T1078 is blocked at the workstation via EDR credential reuse detection with MFA enforcement.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)
RESIDUAL PATH VIABLE ⚡ GDAF-C5C6AA55 Full Domain Compromise Remote Employee → Backup Domain Controller

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked
  • T1078
  • T1078
🕳️ Detection gaps on the residual path
StepControl familyCoveredDetailConfidence
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
🚫 Red's failed alternative attempts
  • Attempted T1110 password spraying — blocked by account lockout policy
2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)
📜 Full debate transcript
Round 1 · RED · viability estimate 0.75
Leverage IPsec VPN gateway credential harvesting (T1190/T1078) to pivot to the Backup Domain Controller via RPC protocol exploitation.
  • VPN gateway accepts unauthenticated IPsec connections — protocol_config: VPN Gateway dataflow: protocol=ipsec, unauthenticated=true (high)
  • Backup Domain Controller exposed via RPC over unencrypted channel — protocol_config: Target dataflow: protocol=rpc, unauthenticated=true, unencrypted=true (high)
Round 1 · BLUE · viability estimate 0.50
T1078 is blocked at the EDR layer via credential reuse pattern detection; T1190 traverses the encrypted IPsec tunnel and cannot be inspected at the gateway, leaving the RPC pivot to the Backup Domain Controller viable but detectable.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: Employee Workstation has mfa_enabled=true per grounding (high)
Round 2 · RED · viability estimate 0.50
T1190 traverses the encrypted IPsec tunnel from the VPN Gateway to the Internal Firewall, evading gateway inspection. From the Internal Fireworkstation, T1078 is blocked by EDR credential reuse detection. However, the Employee Workstation is unencrypted (protocol=tcp) and can pivot to the Primary Domain Controller via LDAP (T1003.001/T1003.006), which is unauthenticated and unencrypted, enabling credential dumping and lateral movement to the Backup Domain Controller.
  • T1190 traverses encrypted IPsec tunnel from VPN Gateway to Internal Firewall — protocol: VPN Gateway dataflow: protocol=ipsec, unauthenticated, encrypted; Internal Firewall dataflow: protocol=ipsec, unauthenticated, encrypted (high)
  • T1078 blocked at EDR layer via credential reuse pattern detection — mitigation: Blue team prior response: T1078 is blocked at the EDR layer via credential reuse pattern detection (high)
  • Employee Workstation protocol is tcp, unauthenticated, unencrypted — protocol: Employee Workstation dataflow: protocol=tcp, unauthenticated, unencrypted (high)
  • Primary Domain Controller accepts unauthenticated LDAP (T1003.001/T1003.006) — protocol: Primary Domain Controller dataflow: protocol=ldap, unauthenticated, unencrypted; candidate techniques: T1003.001, T1003.006, T1558.001 (high)
Round 2 · BLUE · viability estimate 0.50
T1190 traverses the encrypted IPsec tunnel from the VPN Gateway to the Internal Firewall, evading gateway inspection. T1078 is blocked by EDR credential reuse detection on the Internal Fireworkstation. The Employee Workstation pivots to the Primary Domain Controller via unauthenticated, unencrypted LDAP (T1003.001/T1003.006), enabling credential dumping and lateral movement to the Backup Domain Controller.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)
RESIDUAL PATH VIABLE ⚡ GDAF-DFE5A481 Full Domain Compromise External Attacker → Backup Domain Controller

Verdict: Viable but detected — Blue has reliable coverage. Red tried and failed to bypass 2 technique(s); 2 detection gap(s) remain.

✅ Paths Blue successfully blocked
  • T1078
  • T1078
🕳️ Detection gaps on the residual path
StepControl familyCoveredDetailConfidence
hop 2 LDAP credential harvest IDS ❌ No IDS signature for unencrypted LDAP bind with anonymous access on port 389 medium
hop 2 SSH access SIEM ❌ No correlation rule for password-auth SSH from external IP ranges medium
🚫 Red's failed alternative attempts
  • Attempted T1110 password spraying — blocked by account lockout policy
2 round(s) · converged: yes · score adjustment: 1.0× (directional — see docs/evaluation.md)
📜 Full debate transcript
Round 1 · RED · viability estimate 0.75
Leverage unauthenticated SMTP from the mail gateway to deliver a malicious attachment, achieving initial access on the employee workstation. From there, exploit the unencrypted LDAP/AD interface to harvest credentials and move laterally to the Backup Domain Controller via T1003.001.
  • SMTP unauthenticated and unencrypted allows malicious attachment delivery — protocol_config: Mail Gateway dataflow: protocol=smtp, unauthenticated=true, unencrypted=true (high)
  • Employee workstation reachable via SMTP for initial access — protocol_config: Employee Workstation dataflow: protocol=smtp, unauthenticated=true, unencrypted=true (high)
  • LDAP unencrypted and unauthenticated allows credential harvesting — protocol_config: Primary Domain Controller dataflow: protocol=ldap, unauthenticated=true, unencrypted=true (high)
  • Backup Domain Controller RPC interface reachable post-lateral movement — protocol_config: Backup Domain Controller dataflow: protocol=rpc, unauthenticated=true, unencrypted=true (high)
Round 1 · BLUE · viability estimate 0.50
T1078 is blocked at the mail gateway protocol boundary; LDAP harvest and lateral move remain undetected due to missing IDS signatures for anonymous binds.
  • Mail gateway blocks unauthenticated SMTP attachment delivery — protocol_boundary: Mail Gateway [entry] protocol=smtp unauthenticated unencrypted candidate techniques: T1566, T1078, T1078.001 (high)
Round 2 · RED · viability estimate 0.75
Leverage SMTP unauthenticated channel to deliver malicious payload to Backup Domain Controller RPC endpoint, exploiting CVE-2020-1472 for privilege escalation.
  • SMTP unauthenticated delivery allowed to Backup Domain Controller — protocol_boundary: Mail Gateway [entry]: protocol=smtp, unauthenticated, unencrypted (high)
  • CVE-2020-1472 exploitation via RPC unauthenticated bind on Backup Domain Controller — cve: Backup Domain Controller [target]: protocol=rpc, unauthenticated, unencrypted, known CVEs: CVE-2020-1472 (high)
Round 2 · BLUE · viability estimate 0.50
SMTP unauthenticated channel is blocked at the Mail Gateway protocol boundary; T1078 credential reuse is blocked by EDR privilege boundary with MFA enforced on the Employee Workstation; the attack chain is interrupted before reaching the Backup Domain Controller.
  • EDR blocks known T1078 credential reuse pattern on this host — privilege_boundary: hop 2 asset has mfa_enabled=true per grounding (high)
📖 Severity Calculation Explained▶

Threat severity is calculated on a scale of 1.0 to 10.0 using the following factors: 1. **Base Score**: Each STRIDE threat category has a predefined base score (ElevationOfPrivilege: 9.0, Tampering: 8.0, InformationDisclosure: 7.5, Spoofing: 7.0, DenialOfService: 6.0, Repudiation: 5.0). 2. **Impact and Likelihood**: If provided (scale 1–5), their product is normalised and added. 3. **Target Multipliers**: Per-element multipliers from the '## Severity Multipliers' section of the model. 4. **Protocol Adjustments**: SSH +0.5, HTTPS -0.3, HTTP +0.2. 5. **Data Classification**: PUBLIC ×1.0, RESTRICTED ×1.2, SECRET ×1.5, TOP_SECRET ×2.0 multiplier. 6. **VOC Context (when available)**: - Known CVE match for this target: +0.5 - High-risk CWE class (injection, buffer overflow, hardcoded creds…): +0.3 - Network-exposed without authentication or encryption: +0.7 - Active D3FEND defensive controls in place: -0.5 The final score is clamped to [1.0, 10.0] and mapped to INFORMATIONAL / LOW / MEDIUM / HIGH / CRITICAL.

Legend:
* : Indicates a CAPEC or MITRE mapping was manually added to improve relevance.
: Indicates a mitigation has been implemented (as defined in the implemented mitigations file).

🔍 Detailed Threat Analysis

# Target Business Value Source Description Conf. CVEs Severity Risk Signals CAPEC MITRE Techniques MITRE Mitigations D3FEND Mitigations CIS Mitigations NIST Mitigations OWASP Mitigations Detection (SOC)
1
 ot scada zone N/A
AI
(AI) OT SCADA Zone Process Disruption via Network Attack: The OT SCADA Zone has no network-level protections (WAF, IDS, IPS) and no redundancy. An attacker targeting manufacturing availability can directly interfere with critical control loops, causing process disruption or physical damage.
TK-B0AC3A2C
0.90
CRITICAL (10.0)
NET ⛔D3F
  • No specific MITRE mitigations found.
  • No specific D3FEND mitigations found.
  • No specific CIS mitigations found.
  • No specific NIST mitigations found.
  • No specific OWASP mitigations found.
🔍 LOW
Missing logs (4)
  • Sysmon Event 1 — process creation on SCADA HMI with parent=cmd.exe or powershell.exe
  • Sysmon Event 3 — network connections to SCADA ports (502, 20000) from non-OT processes
  • Process telemetry from PLC controllers — unauthorized write/read commands
  • Network flow logs — sustained traffic to Modbus/TCP (502) or DNP3 (20000) from IT subnets
SIEM rules (2)
Non-OT process establishing Modbus TCP connections
SysmonEvent3 AND DestinationPort=502 AND NOT ParentImage IN ('*\svchost.exe', '*\services.exe', '*\plc_daemon.exe')
DNP3 outbound traffic from workstations to SCADA subnet
FlowLog AND DestinationPort=20000 AND SourceZone=Internal AND NOT DestinationIP IN SCADA_whitelist
IOCs (3)
  • Tools: scapy scripts generating malformed Modbus/DNP3 packets, or odictor, dnp3-scan
  • Command line patterns: -m modbus -a <function_code> or -dnp3 -s <ip> -p <port>
  • Process names: scapy, python, perl invoking socket libraries targeting SCADA subnets
2
 dmz N/A
AI
(AI) DMZ Infrastructure Saturation via Volumetric Attack: Without IPS or redundancy protections, the DMZ is susceptible to volumetric Denial of Service attacks. An attacker floods the DMZ entry points with traffic, exhausting bandwidth or connection capacity and preventing legitimate traffic from reaching internal services, directly impacting availability.
TK-FC9913F3
0.90
HIGH (8.7)
NET ⛔D3F
  • No specific MITRE mitigations found.
  • No specific D3FEND mitigations found.
  • No specific CIS mitigations found.
  • No specific NIST mitigations found.
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (3)
  • NetFlow/IPFIX data at DMZ ingress points
  • Web Application Firewall logs for volumetric attack signatures
  • Edge router traffic counters and interface utilization metrics
SIEM rules (2)
DMZ ingress interface utilization threshold
interface_utilization > 80% AND ingress_packets_per_second > 10000 within 1m
High volume SMTP connections to mail gateway
EventID=672 AND count > 500 within 5m grouped by DestinationIP
IOCs (3)
  • Botnet C2 IP ranges in threat intelligence feeds
  • Unusual source port patterns (e.g., 53, 80, 443 used for bulk traffic)
  • Traffic spikes from single external IP to multiple DMZ services
3
 it infrastructure zone N/A
AI
(AI) Ransomware-Induced Encryption of Critical IT Infrastructure: The IT Infrastructure Zone lacks redundancy, IDS/IPS, and robust backup validation. An attacker delivers ransomware via phishing or exploited vulnerability, encrypting critical servers and databases. Without verified backups and with no network segmentation, the entire IT Infrastructure Zone is rendered unavailable, causing cascading failures to dependent systems including the Finance Zone and Active Directory.
TK-23D94C0A
0.90
HIGH (8.7)
NET ⛔D3F
  • No specific MITRE mitigations found.
  • No specific D3FEND mitigations found.
  • No specific CIS mitigations found.
  • No specific NIST mitigations found.
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (4)
  • Endpoint ransomware behavior monitoring (file encryption patterns)
  • Backup server change audit logs with before/after hashes
  • Network egress filtering logs detecting encrypted exfiltration
  • SIEM correlation rules for rapid file extension changes
SIEM rules (2)
Rapid file encryption pattern detection
FileChangeRate > 1000 within 1m AND FileExtension IN (.docx, .xlsx, .pdf, .sql) AND NOT BackupServiceProcess
Ransomware note file creation
NewFileCreation AND FileName MATCHES *README* OR *RECOVER* OR *DECRYPT* AND Directory IN (*Desktop*, *Documents*)
IOCs (3)
  • Known ransomware file hashes from threat intelligence feeds
  • Process encryption patterns: rapid rename-then-delete of office documents
  • Registry key changes: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ransom*
4
 Financial ERP System N/A
pytm
Denial of Service against Financial ERP System through resource-intensive queries or excessive connections
TK-3F468D16
1.00
CRITICAL (9.4)
D3F
—
5
 Core Database Cluster N/A
pytm
Denial of Service against Core Database Cluster through resource-intensive queries or excessive connections
TK-8B41FBB8
1.00
CRITICAL (9.4)
D3F
—
6
 External Attacker → Web Application Firewall → Reverse Proxy → Internal Firewall → Core Database Cluster N/A
LLM
(RAG-LLM) DDoS Amplification and Service Disruption via WAF Bypass: An external attacker launches a DDoS attack targeting the e-commerce platform during a high-traffic period. The attacker attempts to bypass the Web Application Firewall (WAF) and Reverse Proxy by sending crafted HTTP requests that exploit known vulnerabilities or exhaustion vectors. If the WAF is overwhelmed or misconfigured, the traffic reaches the Internal Firewall and ultimately the Kubernetes infrastructure. This could lead to resource exhaustion on the Core Database Cluster and Application Servers, denying service to legitimate customers. The attack may also be used as a smokescreen for concurrent data exfiltration attempts across trust boundaries.
TK-1093001B
0.88
CRITICAL (10.0)
⛔D3F
—
7
 Financial ERP System N/A
AI
(AI) Financial ERP Database Availability Exhaustion via Malformed Queries: The Financial ERP System has no IPS or WAF protection and runs on physical hardware with no redundancy. An attacker with internal network access can send resource-exhausting SQL queries or connection floods, causing database unavailability and halting all financial processing operations, violating IEC 62443 availability requirements.
TK-D370F154
0.90
CRITICAL (9.4)
D3F
🔍 MEDIUM
Missing logs (4)
  • Database — Slow query log or performance schema showing resource-intensive queries
  • Network Flow — High volume of outbound connections from internal hosts to Financial ERP database port
  • SIEM — Database connection pool exhaustion events or application error logs indicating connection failures
  • EDR — Process execution events showing long-running SQL queries or database client tools on internal hosts
SIEM rules (2)
Financial ERP database connection pool exhaustion
Metric: DB_Connection_Pool_Utilization > 90% within 5m AND DB_Active_Queries > 500 per minute
Resource-intensive SQL query patterns from internal hosts
DB_Query_Duration > 30 AND DB_Query_CPU > 5 AND SourceHost NOT IN (FinancialERPCluster)
IOCs (3)
  • Query patterns: 'OR 1=1', 'UNION SELECT', 'DELETE FROM payments', 'DROP TABLE' in database queries
  • Connection patterns: Multiple simultaneous connections from same source to ERP database within short timeframe
  • Process names: 'sqlmap', 'masscan', 'nmap' with database scan scripts
8
 SCADA HMI N/A
AI
(AI) SCADA HMI Service Disruption via RDP Session Flood: The SCADA HMI lacks connection limiting on its RDP endpoint. An attacker sending a high volume of RDP connection requests can exhaust session resources, causing legitimate operators to be locked out during critical manufacturing operations.
TK-5A044240
0.90
HIGH (8.9)
D3F
🔍 HIGH
Missing logs (4)
  • SCADA HMI RDP event logs — session disconnect/reconnect events
  • Network flow logs — RDP connection attempts and duration
  • Endpoint detection and response — RDP process behavior on SCADA segment
  • Windows Security Event 1149 — RDP session reconnection denied
SIEM rules (3)
High volume of RDP connection attempts to SCADA HMI
event_type=rdp_connection AND destination_ip=scada_hmi_ip AND count > 50 within 5m AND source_zone=internal
RDP session establishment without successful authentication
event_type=rdp_authentication_failure AND destination_ip=scada_hmi_ip AND count > 20 within 10m
Unusual RDP session duration patterns
event_type=rdp_session AND session_duration_seconds < 5 AND session_status=connected AND destination_ip=scada_hmi_ip
IOCs (3)
  • Process names: mstsc.exe or rdpclip.exe from unexpected source workstations
  • Source IP addresses from internal subnet not assigned to SCADA operator workstations
  • Failed RDP authentication events from single source IP exceeding threshold
9
 Web Application Firewall N/A
AI
(AI) WAF Rule Set Exhaustion causing Service Unavailability: The Web Application Firewall is a virtual machine with no redundant path. An attacker sending high-volume requests with complex payloads designed to trigger expensive ModSecurity rule evaluations (e.g., heavy regex patterns or deep content inspection) can exhaust the WAF's CPU and memory resources. This causes the WAF to drop legitimate traffic or fail open, effectively performing a Denial of Service on the web application behind it.
TK-8C36BE54
0.90
HIGH (7.6)
NET D3F
🔍 HIGH
Missing logs (5)
  • Web Application Firewall metrics — CPU utilization and request processing latency
  • SIEM logs — ModSecurity rule evaluation events with timestamps and rule IDs
  • Reverse proxy access logs — request volume and processing time per rule set
  • Network flow logs — HTTP request volume and payload size distribution
  • Alerting on WAF virtual machine resource thresholds
SIEM rules (2)
WAF CPU spike due to rule set exhaustion
System_Metrics|Component=WAF AND Metric=CPU_Utilization AND Value > 80 AND Duration > 60s
High volume of complex HTTP requests to WAF
HTTP_Request|DestinationPort=80 OR DestinationPort=443 AND Payload_Size > 2000 AND Request_Count > 100 within 5m
IOCs (3)
  • HTTP request patterns with deeply nested JSON or XML structures designed to maximize ModSecurity evaluation
  • Specific payload signatures known to trigger expensive ModSecurity rules (e.g., base64 encoded strings, recursive patterns)
  • Source IP ranges associated with application layer DDoS tools
10
 Corporate VPN Gateway N/A
AI
(AI) VPN Gateway Connection Flooding: The Corporate VPN Gateway is a physical appliance with no redundancy configured. An attacker can flood the gateway with IKE/IPsec connection requests, exhausting connection table resources and legitimate user bandwidth. This denies remote employees access to critical internal systems, including engineering workstations and potentially OT management interfaces.
TK-A901E1E7
0.90
HIGH (7.6)
NET D3F
🔍 HIGH
Missing logs (3)
  • VPN gateway connection table metrics and threshold alerts
  • IKE authentication attempt logs with source IP and timestamp
  • Network flow logs showing IKE packet rates to VPN gateway
SIEM rules (2)
VPN gateway IKE connection flooding detection
vpn_gateway_logs and ike_connection_attempts and rate(ike_connection_attempts, 1m) > 1000 grouped by source_ip
VPN gateway connection table exhaustion events
vpn_gateway_logs and connection_table_full_events or user_disconnect_events spike
IOCs (3)
  • High volume of IKE SA initiation requests from single or distributed source IPs
  • IKE negotiation requests with aggressive payload sizes or rapid re-negotiation attempts
  • Source IPs from unexpected geographic locations initiating VPN connections
11
 restricted data zone N/A
AI
(AI) Restricted Data Zone Service Availability Disruption: Absence of IPS, IDS, and redundant infrastructure exposes the Restricted Data Zone services to disruption. An attacker can flood or exploit service vulnerabilities to cause outage, impacting business operations.
TK-1086A1BF
0.90
HIGH (7.6)
NET D3F
🔍 LOW
Missing logs (3)
  • Netflow/IPFIX — outbound traffic volume from Restricted Data Zone
  • Web Application Firewall logs — request rate anomalies per source IP
  • Internal IDS/IPS logs — fragmented or malicious payload signatures
SIEM rules (2)
High volume of TCP connections to Restricted Data Zone services
EventID=NAT or FlowLog AND DestinationZone=RestrictedData AND ConnectionCount > 100 within 5m AND Duration < 10s
Application layer request spikes to finance zone endpoints
WAFLog AND EndpointPath contains "/api" AND RequestCount > 200 within 1m grouped by ClientIP
IOCs (3)
  • Tools: hping3, floodnet, or bespoke Python/Perl scripts targeting service ports
  • Command line patterns: --flood, -1, -S or --rate parameters in network tools
  • Unusual process names: hping3, flooder, stress-ng on Restricted Data Zone assets
12
 Remote Employee N/A
AI
(AI) VPN Gateway Connection Flood: The VPN gateway lacks connection rate limiting, allowing an attacker to flood the service with connection requests, displacing legitimate remote employees and disrupting business operations.
TK-B241B621
0.90
MEDIUM (7.0)
NET D3F
🔍 MEDIUM
Missing logs (3)
  • VPN gateway connection rate and throttling configuration logs
  • Internal firewall logs blocking or allowing RDP/SSH from VPN subnet
  • Endpoint process creation events for RDP client from VPN-connected hosts
SIEM rules (2)
VPN gateway connection rate exceeding threshold
EventID=VPN_CONNECT_RATE AND count > 50 within 1m FROM SourceIP AND SourceIP!~trusted_employee_range
RDP session establishment from VPN-connected workstation
EventID=RDP_CONNECT AND SourceProcess=~vpn_client AND DestinationPort=3389
IOCs (3)
  • High volume of VPN connection attempts from single source IP within short timeframe
  • RDP client process (mstsc.exe) launched from VPN-connected endpoint
  • Network flow showing bi-directional traffic on port 3389 from VPN subnet
13
 IT Administrator N/A
AI
(AI) Jump Server RDP Service Exhaustion: The jump server RDP service lacks connection rate limiting; an attacker can flood the service with connection requests, preventing legitimate IT administrators from accessing critical infrastructure for maintenance and incident response.
TK-CEC35D93
0.90
MEDIUM (6.9)
D3F
🔍 HIGH
Missing logs (4)
  • Windows Event ID 4624 — RDP logon attempts with source workstation identification
  • Windows Event ID 4672 — Special privileges assigned to new logon
  • Sysmon Event 1 — Process creation with Image containing mstsc.exe
  • Sysmon Event 3 — Network connections to RDP port (TCP/3389) from non-trusted sources
SIEM rules (2)
High volume of failed RDP logon attempts to jump server
EventID=4625 AND DestinationPort=3389 AND NOT SourceIP IN (IT_Admin_Whitelist) AND count > 20 within 5m
Process creation for mstsc.exe from non-standard sources
EventID=1 AND Image|endswith:\"mstsc.exe" AND SourceIP NOT IN (Corporate_VPN_Gateway_Whitelist)
IOCs (3)
  • IP addresses of compromised hosts used to flood RDP connections
  • User agents or RDP client versions inconsistent with legitimate admin tools
  • Scheduled task creation events (EventID 4689) on jump server triggered by unknown processes
14
 SCADA Operator N/A
AI
(AI) SCADA Operator RDP Session Flood causing HMI Unavailability: The SCADA Operator's RDP session to the HMI is the primary human-machine interface for monitoring the manufacturing process. A DoS attack targeting the RDP service or the operator's workstation could lock the session, causing the operator to lose visibility and control. In a critical manufacturing environment, even a brief loss of HMI access can trigger safety mechanisms or prevent timely response to process deviations.
TK-B841E514
0.90
MEDIUM (6.9)
D3F
🔍 HIGH
Missing logs (5)
  • Windows Event ID 4625 — Failed RDP logon attempts with account lockout information
  • Windows Event ID 4671 — License session limit reached
  • Sysmon Event 1 — Process creation events for mstsc.exe with unusual command line arguments
  • Network flow logs — RDP traffic volume and connection rate to HMI
  • EDR telemetry — workstation resource utilization spikes (CPU, memory) during RDP sessions
SIEM rules (2)
RDP session flood detection against SCADA HMI
EventID=4625 AND DestinationIP=SCADA_HMI_IP AND LogonType=10 AND count > 5 within 1m
HMI RDP connection rate anomaly
Sysmon Event 3 | DestinationPort=3389 AND SourceVLAN=IT_Network AND DestinationIP=SCADA_HMI_IP AND connection_rate > 10 per minute
IOCs (3)
  • IP addresses or subnets of known botnet C2 servers used for RDP flooding
  • Command line arguments typical of RDP brute-force tools (e.g., /dict, /list)
  • Process names associated with RDP stress testing tools
15
 Internal DNS Server N/A
AI
(AI) DNS Server Resource Exhaustion via Recursive Queries: The DNS server is configured to perform recursive queries for external domains without rate limiting or query restrictions. An attacker sends a high volume of queries for non-existent or external domains, exhausting server resources and causing legitimate DNS resolution to fail.
TK-DB3BD3A6
0.90
MEDIUM (6.9)
D3F
🔍 MEDIUM
Missing logs (3)
  • DNS server query logs with rate counting per source IP
  • DNS server response performance metrics (CPU, memory, queue length)
  • Network flow logs showing DNS query volume trends
SIEM rules (2)
DNS server recursive query volume spike from single source
dns_query_logs and query_recursive=1 and rate(count, 1m) > 500 grouped by source_ip
DNS server resource utilization anomalies
dns_server_metrics and (cpu_usage > 80 OR memory_usage > 80) during query flood events
IOCs (3)
  • High volume of queries for non-existent domains (.invalid, .localdomain, random subdomains)
  • Query patterns showing random subdomain generation (potential DGA indicators)
  • Source IPs with sustained high DNS query rates exceeding baseline
16
 File Server N/A
AI
(AI) SMB Share Availability Disruption via File Locking: Lack of redundant storage and unsecured SMB shares allow an attacker to deny service to legitimate users by locking files or filling disk space, halting manufacturing operations that depend on shared data.
TK-ED7EE943
0.90
MEDIUM (6.9)
D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (3)
  • File Server SMB Audit — File open/lock events (Security Event 5145/5146)
  • File Server SMB Audit — Disk capacity alerts and free space monitoring
  • Endpoint AV/EDR — File creation events with high-frequency patterns on SMB shares
SIEM rules (2)
SMB file lock duration exceeding threshold
EventID=5145 AND LockDuration > 300 AND User != 'SYSTEM' AND User != 'Administrator'
SMB disk space consumption spike
EventID=5146 AND FileSize > 10MB AND DestinationPath CONTAINS 'share_name' AND NOT User IN ('svc_account', 'backup_user')
IOCs (3)
  • Command line patterns: 'cipher /e /f /i' executed on SMB shares
  • Process names: 'cscript.exe', 'wscript.exe' with SMB file paths
  • Repeated file lock events from same source IP to file server share
17
 Finance Workstation N/A
AI
(AI) Finance Workstation Disk Wipe or Ransomware Execution: The Finance Workstation has no IDS/IPS protection and no redundant storage. A single click on a malicious link or attachment can execute ransomware that encrypts local files, wiping out unsaved work, financial spreadsheets, and local caches required for daily operations, causing operational disruption.
TK-417AB55C
0.90
MEDIUM (6.9)
D3F
  • No specific OWASP mitigations found.
🔍 HIGH
Missing logs (4)
  • Endpoint AV/EDR — Ransomware behavior detection (file encryption, ransom note creation)
  • File Server — Shadow copy creation events and ransomware mitigation alerts
  • Mail Gateway — Malware attachment detection for common ransomware payloads
  • Workstation — Behavioral analytics: sudden high volume of file encryption events
SIEM rules (2)
Ransomware file encryption behavior on Finance Workstation
EndpointEvent AND FileEncryptionRate > 10� per minute AND Process NOT IN (known_backup_tools) AND User = 'finance_user'
Ransom note creation events
FileCreate AND FileName MATCHES '*.ransom* OR *README* OR *RECOVER*' AND Directory CONTAINS 'Finance'
IOCs (4)
  • Process names: 'cryptographic', 'encryption', 'locker' variants
  • File extensions: .encrypted, .locked, .ransomware appended to finance reports
  • Registry keys: ransomware note paths or ransom payment instructions
  • Outbound connections to known ransomware payment TOR endpoints or cryptocurrency wallets
18
 CI CD Pipeline N/A
AI
(AI) CI/CD Pipeline Resource Exhaustion and Build Interruption: The CI/CD Pipeline runs on a virtual machine with no redundant resources and no IPS/WAF protection. An attacker who can trigger pipeline builds (e.g., by pushing many small commits or exploiting a webhook) can exhaust CPU, memory, or disk space on the pipeline executor, causing build failures and delaying all software delivery and deployment activities, including critical security patch deployment to production systems.
TK-B622CAAE
0.90
MEDIUM (6.9)
D3F
🔍 LOW
Missing logs (4)
  • CI/CD pipeline executor stdout/stderr logs — build output and resource usage metrics
  • Host-level process monitoring — CPU, memory, disk I/O for pipeline VM
  • Webhook event logs — git push triggers and payload metadata
  • Container orchestration logs — Kubernetes API server audit for build triggers
SIEM rules (2)
High volume of git push events to CI/CD pipeline within short timeframe
event_type=webhook AND event_name=git_push AND count(destination_ip) > 20 within 5m AND source_repo NOT in (approved_repos)
CI/CD pipeline build duration anomalies
event_type=build_metric AND build_duration_seconds < 30 AND build_status=failed AND resource_type=CPU
IOCs (3)
  • Automated git push scripts from unfamiliar source IPs
  • Webhook payloads with abnormally large commit counts or empty commit messages
  • CI/CD pipeline VM with unusually high disk write activity during idle periods
19
 Corporate Employee N/A
AI
(AI) RDP Session Flooding and Workstation Resource Exhaustion: An attacker sends repeated RDP connection requests to the employee workstation, overwhelming system resources and causing denial of service for the legitimate user, disrupting daily manufacturing operations.
TK-A1C69C4F
0.90
LOW (5.1)
D3F
🔍 MEDIUM
Missing logs (3)
  • Workstation process creation events for mstsc.exe
  • RDP service performance metrics (CPU, memory utilization thresholds)
  • Endpoint behavioral analytics for RDP connection rate anomalies
SIEM rules (2)
Rapid RDP connection attempts to single workstation
EventID=RDP_CONNECT AND DestinationWorkstation=~target AND count > 20 within 5m grouped by SourceIP
RDP service resource utilization anomaly
HostMetric=CPU > 80 AND ProcessName=mstsc.exe AND time_window > 10m
IOCs (3)
  • Automated RDP connection scripts or tools (Bulk RDP, mstsc.exe with /f parameter)
  • Source IP addresses associated with RDP brute-force tooling
  • Unusual process command lines for mstsc.exe (e.g., /admin, /multimon)
# Target Business Value Source Description Conf. CVEs Severity Risk Signals CAPEC MITRE Techniques MITRE Mitigations D3FEND Mitigations CIS Mitigations NIST Mitigations OWASP Mitigations Detection (SOC)
1
 Edge Router N/A
pytm
Vulnerability in the management interface of Edge Router leading to critical privilege escalation
TK-67648CA9
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
2
 Web Application Firewall N/A
pytm
Vulnerability in the management interface of Web Application Firewall leading to critical privilege escalation
TK-20EDB887
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
3
 Primary Domain Controller N/A
pytm
Unauthorized privilege escalation on Primary Domain Controller due to misconfiguration or vulnerability
TK-52F52E28
1.00
CRITICAL (10.0)
D3F
—
4
 PKI Certificate Authority N/A
pytm
Unauthorized privilege escalation on PKI Certificate Authority due to misconfiguration or vulnerability
TK-AAF0E82C
1.00
CRITICAL (10.0)
D3F
—
5
 Financial ERP System N/A
pytm
Unauthorized privilege escalation on Financial ERP System due to misconfiguration or vulnerability
TK-20C03A7B
1.00
CRITICAL (10.0)
D3F
—
6
 Core Database Cluster N/A
pytm
Unauthorized privilege escalation on Core Database Cluster due to misconfiguration or vulnerability
TK-A263F6C2
1.00
CRITICAL (10.0)
D3F
—
7
 SCADA HMI N/A
pytm
Unauthorized privilege escalation on SCADA HMI due to misconfiguration or vulnerability
TK-C2B1BEBD
1.00
CRITICAL (10.0)
D3F
—
8
 PLC Controller N/A
pytm
Unauthorized privilege escalation on PLC Controller due to misconfiguration or vulnerability
TK-47AF2A57
1.00
CRITICAL (10.0)
D3F
—
9
 Internal Firewall N/A
pytm
Vulnerability in the management interface of Internal Firewall leading to critical privilege escalation
TK-66772138
1.00
CRITICAL (9.5)
D3F
  • No specific OWASP mitigations found.
—
10
 Remote Employee N/A
AI
(AI) VPN Gateway Credential Theft and Replay: The IPsec VPN gateway relies on two-factor authentication; however, if an attacker steals the employee's credentials via phishing or malware, they can establish a trusted internal network session and access protected resources.
TK-384C4B88
0.90
CRITICAL (10.0)
NET D3F
🔍 HIGH
Missing logs (3)
  • Corporate VPN gateway authentication logs with MFA success/failure details
  • Endpoint process creation events for child processes of VPN client
  • Network connection events from VPN subnet to internal file shares and DCs
SIEM rules (3)
VPN credential reuse from unusual source IP
EventID=VPN_AUTH AND MFAStatus=fail AND SourceIP!~employee_home_range AND count > 1 within 10m
IPsec tunnel establishment from non-corporate managed device
EventID=IPSEC_CONNECT AND DeviceCategory=~unmanaged AND UserDomain=~corp_domain
File share access immediately following VPN connection
EventID=FILE_ACCESS AND SourceProcess=~vpn_client AND TargetPath=~\\* AND time_diff < 2m from VPN_CONNECT
IOCs (3)
  • VPN credential material (hashes or tokens) found in endpoint telemetry or dark web feeds
  • Unmanaged device certificates presented to VPN gateway
  • Outbound SMB (TCP/445) connections from VPN-connected endpoints to non-standard file shares
11
 vpn perimeter N/A
AI
(AI) VPN Credential Theft and Reuse for Unauthorized Access: The VPN perimeter lacks authentication controls, relying solely on network connectivity. Attackers can obtain VPN credentials through phishing, credential stuffing from previous breaches, or malware, and reuse them to establish secure tunnels into the internal network. Once connected, the attacker appears as a legitimate remote user, bypassing perimeter defenses.
TK-E6DC1797
0.90
CRITICAL (10.0)
NET D3F
🔍 HIGH
Missing logs (3)
  • Corporate VPN gateway authentication logs with source IP mapping
  • Endpoint VPN client logs showing connection timestamps and duration
  • Multi-factor authentication push notification logs
SIEM rules (2)
VPN login outside typical hours for user
EventID=25 AND source_user NOT IN (typical_hours_users) AND hour(login_time) NOT IN (8,9,10,11,12,13,14,15,16,17)
VPN connection from unusual geolocation
source_ip_country != user_home_country AND mfa_push_event NOT recent
IOCs (3)
  • Known VPN credential dumps from previous breach databases
  • RDP client artifacts in %APPDATA% associated with VPN sessions
  • Unusual process tree: vpnclient.exe -> cmd.exe -> powershell.exe
12
 internal network N/A
AI
(AI) Lateral Movement via Stolen Domain Credentials: The Internal Network trust boundary is unprotected by IDS/IPS and lacks documented authentication controls. An attacker who has obtained valid domain credentials (e.g., through phishing or insider threat) can move laterally across the internal network with minimal resistance. The absence of network monitoring allows the attacker to enumerate hosts, access file shares, and pivot toward critical infrastructure such as the Active Directory forest.
TK-7D965D78
0.90
CRITICAL (10.0)
NET D3F
🔍 MEDIUM
Missing logs (3)
  • Sysmon Event 1 — process creation with command-line arguments
  • Sysmon Event 3 — network connections from non-browser processes
  • Windows Security Event 4688 — process creation with parent-child relationships
SIEM rules (2)
Non-browser process making network connections
EventID=3 AND Image NOT IN (*explorer.exe, *chrome.exe, *firefox.exe) AND DestinationPort != 443
Enumeration tools execution
Image IN (*net.exe, *ipconfig.exe, *nslookup.exe, *ping.exe) AND CommandLine CONTAINS /domain OR /all
IOCs (3)
  • Process command lines containing net view, enum4linux, or similar enumeration commands
  • SMB session creation from non-server workstations (EventID=5145)
  • DNS queries for internal AD domains from unexpected hosts
13
 it infrastructure zone N/A
AI
(AI) Unpatched Server Exploitation for Domain Admin Compromise: The IT Infrastructure Zone executes critical workloads without documented patch management, IDS, or IPS protections. An attacker exploits a known vulnerability in a publicly accessible or internally reachable service to gain remote code execution. Given the zone's trusted status and connectivity to the Active Directory forest, the attacker can harvest credentials and escalate to domain administrator level, compromising the entire identity infrastructure.
TK-92CD0F38
0.90
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
🔍 HIGH
Missing logs (4)
  • Sysmon Event 1 — process creation with command-line arguments
  • Sysmon Event 7 — driver loading events
  • Endpoint detection and response (EDR) telemetry for known exploit patterns
  • Application control logs (AppLocker/WDAC) blocking unauthorized executables
SIEM rules (2)
Known vulnerability exploitation attempt
EventID=1 AND GrantedAccess != 0
Credential dumping after exploit
EventID=1 AND (ProcessAccess=lsass OR Image IN (*mimikatz.exe, *procdump.exe))
IOCs (3)
  • Exploit kit landing page domains associated with targeted vulnerability
  • Mimikatz command-line arguments: -accepteula, -minidump
  • Registry run keys referencing newly created executables in %TEMP% or %APPDATA%
14
 finance zone N/A
AI
(AI) Domain Admin Credential Theft via Finance Zone Lateral Movement: The Finance Zone trust boundary lacks network segmentation controls and IDS/IPS detection. An attacker who initially compromises a less sensitive system can pivot through the Internal Network to reach Finance Zone workstations or servers. Once access is achieved, the attacker harvests stored credentials, which often have elevated privileges due to the operational needs of financial processing systems, enabling domain administrator compromise.
TK-427B592D
0.90
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (4)
  • Sysmon Event 1 — process creation with command-line across zones
  • Sysmon Event 3 — network connections with source/destination zone tagging
  • Active Directory change audit logs for credential harvesting
  • Finance zone to internal network traffic flow logs
SIEM rules (2)
Lateral movement from internal workstation to finance zone
EventID=1 AND SourceZone IN (internal, it_infra) AND DestinationZone = finance AND NOT User IN (finance_admins)
Credential dumping from finance systems
Image IN (*mimikatz.exe, *procdump.exe) AND TargetProcess IN (*lsass.exe, *srv.exe) AND TargetZone = finance
IOCs (3)
  • Process execution chains: initial_compromise.exe -> mimikatz.exe -> svchost.exe
  • SMB session initiation from non-finance workstations to finance file servers (EventID=5145)
  • DNS TXT records from finance zones containing domain credentials or tokens
15
 Edge Router N/A
pytm
Unauthorized privilege escalation on Edge Router due to misconfiguration or vulnerability
TK-74070B8C
1.00
CRITICAL (9.2)
NET D3F
—
16
 Web Application Firewall N/A
pytm
Unauthorized privilege escalation on Web Application Firewall due to misconfiguration or vulnerability
TK-EECA1DB1
1.00
CRITICAL (9.2)
NET D3F
—
17
 Reverse Proxy N/A
pytm
Unauthorized privilege escalation on Reverse Proxy due to misconfiguration or vulnerability
TK-BE06A071
1.00
CRITICAL (9.2)
NET D3F
—
18
 Mail Gateway N/A
pytm
Unauthorized privilege escalation on Mail Gateway due to misconfiguration or vulnerability
TK-7344605D
1.00
CRITICAL (9.2)
NET D3F
—
19
 Corporate VPN Gateway N/A
pytm
Unauthorized privilege escalation on Corporate VPN Gateway due to misconfiguration or vulnerability
TK-3C4A06FC
1.00
CRITICAL (9.2)
NET D3F
—
20
 Core Database Cluster N/A
AI
(AI) SQL Injection via CI/CD Pipeline Credentials: The CI/CD pipeline authenticates to the database cluster with credentials that may have excessive privileges. If the pipeline or its artifacts are compromised, SQL injection techniques can extract, modify, or delete data beyond intended scope.
TK-08140490
0.90
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (4)
  • Database audit log — SQL queries executed with pipeline credentials
  • CI/CD pipeline script execution logs — commands run and arguments passed
  • File integrity monitoring — changes to pipeline credential files or environment variables
  • Endpoint detection and response — credential access patterns from pipeline process
SIEM rules (2)
SQL queries executed with CI/CD pipeline user context
db_audit_log AND user=ci_pipeline_user AND (query LIKE '%UNION%' OR query LIKE '%SELECT% FROM information_schema%)
Pipeline script execution with unusual arguments
process_creation AND parent_process=ci_runner AND (command_line contains '--password' OR command_line contains 'PGPASSWORD' AND NOT command_line contains expected_pattern)
IOCs (3)
  • CI/CD pipeline credentials appearing in process command lines or environment variables
  • Unusual SQL patterns in database audit logs: UNION-based injection, information_schema access
  • Modifications to pipeline configuration files containing database connection strings
21
 IT Administrator N/A
AI
(AI) Jump Server RDP Session Pivot to IT Infrastructure: The IT administrator connects to the jump server via encrypted RDP with two-factor authentication; if the jump server is compromised or misconfigured, an attacker can pivot from the administrator session to the broader IT infrastructure, including domain controllers and server farms.
TK-7344283E
0.90
CRITICAL (9.5)
D3F
  • No specific OWASP mitigations found.
🔍 HIGH
Missing logs (3)
  • Jump server RDP session logs with user and terminal ID
  • Privileged session monitoring and recording for jump server
  • Endpoint process creation events following jump server RDP session
SIEM rules (3)
RDP session from jump server to internal infrastructure
EventID=RDP_SESSION AND SourceHost=~jump_server AND DestinationHost=~it_infra AND User=~it_admin
Unusual process execution following jump server RDP
EventID=PROCESS_CREATE AND ParentProcess=~mstsc.exe AND time_diff < 1m AND User=~it_admin
Jump server administrator login from unusual source
EventID=LOGON_AND SourceWorkstation=~unmanaged AND User=~it_admin AND count > 1 within 24h
IOCs (3)
  • RDP session initiation from jump server to domain controllers or critical infrastructure
  • Itadmin.exe or other privileged process execution from jump server session
  • Outbound WinRM (HTTP/HTTPS 5985/5986) from jump server to internal endpoints
22
 SCADA Operator N/A
AI
(AI) SCADA Operator Credential Theft and Domain Admin Lateral Movement: The SCADA Operator uses RDP with credentials to access the HMI. If the operator's workstation is compromised via phishing or pass-the-hash attacks, the captured RDP credentials can be used to lateral move into the Active Directory forest, given that the OT/SCADA zone is the root of all access control. This allows the attacker to re-engineer access policies and gain unrestricted control over both IT and OT systems.
TK-432B4ECA
0.90
CRITICAL (9.5)
D3F
🔍 HIGH
Missing logs (5)
  • Windows Event ID 4624 — Logon Type 10 (RDP) with Logon Process information
  • Windows Event ID 4672 — Special privileges assigned to new logon
  • Sysmon Event 1 — Process creation events on SCADA operator's workstation
  • Sysmon Event 7 — Image loaded events for credential dumping tools
  • Active Directory replication changes — new privileged accounts created
SIEM rules (2)
RDP credential extraction from SCADA operator workstation
EventID=4688 AND (Image|endswith:\"cmd.exe" OR Image|endswith:\"powershell.exe") AND CommandLine|contains:\"clipboard\" AND User=SCADA_Operator
Pass-the-hash or credential reuse from SCADA operator context
EventID=4624 AND LogonType=10 AND SourceWorkstation IN (SCADA_Operator_Workstation) AND NOT SourceIP IN (Trusted_OT_VLAN)
IOCs (3)
  • Process names mimikatz.exe, gsecdump, or lazarus on SCADA operator's workstation
  • Registry keys related to WDigest credential storage under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
  • Outbound LDAP queries from SCADA operator's workstation to Domain Controllers at unusual times
23
 Internal Firewall N/A
pytm
Unauthorized privilege escalation on Internal Firewall due to misconfiguration or vulnerability
TK-DD6491BC
1.00
HIGH (8.5)
D3F
—
24
 Internal DNS Server N/A
pytm
Unauthorized privilege escalation on Internal DNS Server due to misconfiguration or vulnerability
TK-E1C5EB58
1.00
HIGH (8.5)
D3F
—
25
 Employee Workstation N/A
pytm
Unauthorized privilege escalation on Employee Workstation due to misconfiguration or vulnerability
TK-F723CDE8
1.00
HIGH (8.5)
D3F
—
26
 File Server N/A
pytm
Unauthorized privilege escalation on File Server due to misconfiguration or vulnerability
TK-6433647B
1.00
HIGH (8.5)
D3F
—
27
 Backup Domain Controller N/A
pytm
Unauthorized privilege escalation on Backup Domain Controller due to misconfiguration or vulnerability
TK-61110188
1.00
HIGH (8.5)
D3F
—
28
 SIEM Server N/A
pytm
Unauthorized privilege escalation on SIEM Server due to misconfiguration or vulnerability
TK-821BE7BA
1.00
HIGH (8.5)
D3F
—
29
 Jump Server N/A
pytm
Unauthorized privilege escalation on Jump Server due to misconfiguration or vulnerability
TK-34956B40
1.00
HIGH (8.5)
D3F
—
30
 Finance Workstation N/A
pytm
Unauthorized privilege escalation on Finance Workstation due to misconfiguration or vulnerability
TK-1B83C41A
1.00
HIGH (8.5)
D3F
—
31
 Source Code Repository N/A
pytm
Unauthorized privilege escalation on Source Code Repository due to misconfiguration or vulnerability
TK-E9D6AC19
1.00
HIGH (8.5)
D3F
—
32
 CI CD Pipeline N/A
pytm
Unauthorized privilege escalation on CI CD Pipeline due to misconfiguration or vulnerability
TK-9580A827
1.00
HIGH (8.5)
D3F
—
33
 Backup Server N/A
pytm
Unauthorized privilege escalation on Backup Server due to misconfiguration or vulnerability
TK-458B0611
1.00
HIGH (8.5)
D3F
—
34
 External Attacker N/A
pytm
Privilege abuse by actor External Attacker to gain unauthorized access or perform unauthorized actions
TK-28866B23
1.00
HIGH (7.6)
NET D3F
—
35
 Remote Employee N/A
pytm
Privilege abuse by actor Remote Employee to gain unauthorized access or perform unauthorized actions
TK-A1E486A6
1.00
HIGH (7.6)
NET D3F
—
36
 Employee Workstation → Jump Server → Active Directory → Core Database Cluster N/A
LLM
(RAG-LLM) Credential Theft and Lateral Movement via Jump Server: An attacker who has initially compromised an Employee Workstation (via phishing or malware) leverages the EmployeeToWorkstation dataflow (RDP) to move laterally. The attacker then targets the Jump Server (ITAdminToJump dataflow via RDP). Compromising the Jump Server provides a privileged foothold within the internal network, bypassing the Internal Firewall. From the Jump Server, the attacker can reach the Active Directory (JumpToAD via WinRM), Primary Domain Controller, and ultimately the Core Database Cluster and Financial ERP System, enabling full domain compromise and data exfiltration.
TK-2B1B67D2
0.72
CRITICAL (9.9)
⛔D3F
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • No specific OWASP mitigations found.
—
37
 Jump Server N/A
pytm
Lateral movement from management server Jump Server to other systems in the network for further compromise.
TK-CE2E68B5
1.00
HIGH (7.7)
D3F
  • No specific OWASP mitigations found.
—
38
 Reverse Proxy N/A
AI
(AI) Reverse Proxy Configuration Tampering leading to Internal Network Pivot: The nginx Reverse Proxy configuration files reside on a virtual machine. If an attacker gains write access to the nginx configuration (e.g., via a vulnerable application on the proxy, file inclusion, or compromised credentials), they can modify the proxy rules to redirect traffic, add malicious rewrite rules, or expose internal services. This effectively pivots the attacker from the DMZ into the trusted internal network behind the Internal Firewall.
TK-8791DE6D
0.90
HIGH (8.2)
NET D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (3)
  • Web server access logs with response body inspection
  • File integrity monitoring for /etc/nginx/nginx.conf and /etc/nginx/sites-enabled/
  • Reverse proxy access logs showing upstream service connections
SIEM rules (2)
Reverse proxy config modification detected
FileIntegrityChange and target_path ends with 'nginx.conf' and (user != 'root' OR event_type != 'deployment')
Internal service accessed via reverse proxy from external IP
reverse_proxy_access_logs and destination_service in_internal_network and source_ip not in trusted_external_ips
IOCs (3)
  • Unusual nginx server_name or proxy_pass directives in config files
  • Outbound HTTP connections from reverse proxy to internal services not on allowlist
  • Modified index.html or error pages on reverse proxy VM
39
 Corporate VPN Gateway N/A
AI
(AI) IPsec Tunnel Manipulation via Weak Cryptographic Negotiation: The VPN Gateway uses Cisco ASA with IPsec, but the absence of specified strong cryptographic suites creates a risk. If the gateway negotiates with a legacy or weak cipher (e.g., 3DES or MD5), an attacker performing a man-in-the-middle attack on the network path can decrypt or manipulate tunneled traffic. This could allow injection of malicious commands into the internal network.
TK-A4251971
0.90
HIGH (8.2)
NET D3F
  • No specific OWASP mitigations found.
🔍 LOW
Missing logs (3)
  • IPsec SA negotiation logs from VPN Gateway with cipher suite details
  • Firewall/IDS logs capturing IKE packet captures or negotiation metadata
  • Endpoint logs showing IPsec client connection attempts with encryption settings
SIEM rules (2)
VPN IKE negotiation with weak cipher suite
vpn_gateway_logs and ike_sa_negotiation and (cipher in ('3DES','MD5') or hash in ('MD5'))
Multiple IKE SA establishment failures
vpn_gateway_logs and ike_failure_events and count > 5 within 1m from same source_ip
IOCs (3)
  • IKE proposal with 3DES_CBC or MD5 hash options
  • Phase 1 negotiation requests from unusual source ports or locations
  • VPN client config referencing legacy cipher suites
40
 internet N/A
AI
(AI) External Service Credential Leakage via Internet Exposure: Internet-facing services may inadvertently expose credentials, API keys, or connection strings in error messages, logs, or public repositories. An attacker harvesting these can authenticate to internal systems or pivot from the internet-facing surface to the internal network.
TK-B48C005D
0.90
HIGH (8.2)
NET D3F
  • No specific OWASP mitigations found.
🔍 HIGH
Missing logs (4)
  • Web application firewall logs — error messages and response bodies from internet-facing services
  • Source code repository scanning — exposed credential patterns in code and configs
  • Dark web monitoring — leaked credentials appearing in paste sites and forums
  • Email security gateway logs — credentials sent via email or found in attachments
SIEM rules (2)
Internet-facing service error messages containing credential-like patterns
waf_log AND (response_body contains ":" AND response_body matches ".*[a-zA-Z0-9]{20,}.*" OR response_body matches ".*skey.*" OR response_body matches ".*password.*")
CI/CD pipeline or source code repository credential exposure
code_repo_scan AND (file_type=yml OR file_type=json OR file_type=env) AND (content matches ".*AKIA.*" OR content matches ".*AWS_SECRET" OR content matches ".*db_password")
IOCs (3)
  • Error message patterns from internet services: database connection strings, API keys, AWS access keys
  • Git repository commits containing: AWS_ACCESS_KEY_ID, API_SECRET, database passwords in plaintext
  • Configuration files exposed in public directories: .env, config.yml with credential variables
41
 Corporate Employee N/A
pytm
Privilege abuse by actor Corporate Employee to gain unauthorized access or perform unauthorized actions
TK-4E05940D
1.00
MEDIUM (6.9)
D3F
—
42
 Finance Employee N/A
pytm
Privilege abuse by actor Finance Employee to gain unauthorized access or perform unauthorized actions
TK-AD694F75
1.00
MEDIUM (6.9)
D3F
—
43
 IT Administrator N/A
pytm
Privilege abuse by actor IT Administrator to gain unauthorized access or perform unauthorized actions
TK-1FAA902B
1.00
MEDIUM (6.9)
D3F
—
44
 Developer N/A
pytm
Privilege abuse by actor Developer to gain unauthorized access or perform unauthorized actions
TK-BC8F9D3D
1.00
MEDIUM (6.9)
D3F
—
45
 SCADA Operator N/A
pytm
Privilege abuse by actor SCADA Operator to gain unauthorized access or perform unauthorized actions
TK-0AA5EC85
1.00
MEDIUM (6.9)
D3F
—
46
 External Attacker N/A
AI
(AI) SMTP Relay Abuse for Lateral Movement: The mail gateway can be coerced into relaying messages to internal systems, enabling attackers to deliver malicious payloads that exploit internal trust relationships and achieve privilege escalation.
TK-B1583D14
0.90
MEDIUM (6.2)
NET D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (3)
  • Mail Gateway SMTP session logs with relay restrictions status
  • Active Directory Account Policy changes enabling or disabling relay
  • Network flow logs showing SMTP traffic from gateway to internal zones
SIEM rules (2)
SMTP relay attempt from gateway to internal zones
EventID=SMTP_RELAY AND Direction=Outbound AND RecipientDomain=~internal AND SenderAuthStatus=fail
Mail gateway forwarding mail with forged internal sender
EventID=MAIL_FOREWARD AND SenderDomain=~internal AND SenderIP=~gateway_outbound
IOCs (3)
  • Outbound SMTP (TCP/25) from mail gateway to internal Active Directory domains
  • Mail gateway configuration allowing relay for internal domains without authentication
  • Suspicious attachment types in internally-originated but externally-routed email (*.scr, *.exe, *.ps1)
47
 Source Code Repository N/A
AI
(AI) Source Code Repository Git Remote Hijacking via DNS or SSH Manipulation: The Source Code Repository is accessed over HTTPS and SSH on the internal network. An attacker performing a man-in-the-middle attack on the internal network (e.g., via ARP spoofing from a compromised workstation) can redirect git fetch/push operations to a malicious server, or intercept HTTPS traffic if TLS inspection is not enforced, allowing code injection or credential theft during repository operations.
TK-CD380D2B
0.90
LOW (5.8)
⛔D3F
  • No specific MITRE mitigations found.
  • No specific D3FEND mitigations found.
  • No specific CIS mitigations found.
  • No specific NIST mitigations found.
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (4)
  • Sysmon Event 3 — network connections from non-browser processes to non-standard ports
  • Sysmon Event 7 — image loaded events for git.exe or ssh.exe from workstation
  • Network flow logs — ARP spoofing indicators or duplicate IP detection
  • Zeek/Network Security Monitoring — DNS response anomalies for git domains
SIEM rules (3)
Git or SSH traffic to unexpected external IP from internal workstation
event_type=network_connection AND (process_name=git.exe OR process_name=ssh.exe) AND (destination_port != 22 OR destination_port != 9418) AND source_zone=internal AND dest_zone=external
ARP spoofing detection via duplicate IP responses
event_type=arp AND ip_conflict_detected=true AND source_zone=internal
DNS resolution for git hosting domains from non-standard processes
dns_query_name contains ".git" OR dns_query_name contains ".github" AND process_name NOT in (chrome.exe, firefox.exe, edge.exe)
IOCs (4)
  • ARP cache poisoning indicators: duplicate MAC addresses for same IP
  • Process command lines: git.exe push/pull to external IP not matching git remote origin
  • SSH known_hosts changes or connections to unfamiliar host keys
  • Outbound HTTPS connections to port 443 IPs not matching git hosting ASNs
# Target Business Value Source Description Conf. CVEs Severity Risk Signals CAPEC MITRE Techniques MITRE Mitigations D3FEND Mitigations CIS Mitigations NIST Mitigations OWASP Mitigations Detection (SOC)
1
 EmployeeToWorkstation N/A
pytm
Credentials in dataflow from Corporate Employee to Employee Workstation are sent over an unencrypted channel.
TK-40CD0015
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
2
 WorkstationToAD N/A
pytm
Credentials in dataflow from Employee Workstation to Primary Domain Controller are sent over an unencrypted channel.
TK-546F6F41
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
3
 WorkstationToFile N/A
pytm
Credentials in dataflow from Employee Workstation to File Server are sent over an unencrypted channel.
TK-4AF5BA34
1.00
CRITICAL (10.0)
NET D3F
—
4
 ADToBackupAD N/A
pytm
Credentials in dataflow from Primary Domain Controller to Backup Domain Controller are sent over an unencrypted channel.
TK-1D82530B
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
5
 SIEMToAD N/A
pytm
Credentials in dataflow from SIEM Server to Primary Domain Controller are sent over an unencrypted channel.
TK-D79B82BA
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
6
 JumpToSCADA N/A
pytm
Credentials in dataflow from Jump Server to SCADA HMI are sent over an unencrypted channel.
TK-5EB1E7EA
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
7
 JumpToERP N/A
pytm
Credentials in dataflow from Jump Server to Financial ERP System are sent over an unencrypted channel.
TK-3007A20E
1.00
CRITICAL (10.0)
NET D3F
—
8
 FinanceEmpToERP N/A
pytm
Credentials in dataflow from Finance Employee to Financial ERP System are sent over an unencrypted channel.
TK-6B048745
1.00
CRITICAL (10.0)
NET D3F
—
9
 ERPToCoreDB N/A
pytm
Credentials in dataflow from Financial ERP System to Core Database Cluster are sent over an unencrypted channel.
TK-E64CA025
1.00
CRITICAL (10.0)
NET D3F
—
10
 CICDToCoreDB N/A
pytm
Credentials in dataflow from CI CD Pipeline to Core Database Cluster are sent over an unencrypted channel.
TK-25B47741
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
11
 CoreDBToBackup N/A
pytm
Credentials in dataflow from Core Database Cluster to Backup Server are sent over an unencrypted channel.
TK-1A5E0A9C
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
12
 SCADAOpToHMI N/A
pytm
Credentials in dataflow from SCADA Operator to SCADA HMI are sent over an unencrypted channel.
TK-B6015A2B
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
13
 Financial ERP System N/A
pytm
Critical data-at-rest on server Financial ERP System is not encrypted, leading to severe information disclosure if compromised.
TK-844D43D2
1.00
CRITICAL (10.0)
D3F
—
14
 Financial ERP System N/A
pytm
Unauthorized access to sensitive data stored in Financial ERP System leading to data breach
TK-0E3089C9
1.00
CRITICAL (10.0)
D3F
—
15
 Core Database Cluster N/A
pytm
Unauthorized access to sensitive data stored in Core Database Cluster leading to data breach
TK-39689F68
1.00
CRITICAL (10.0)
D3F
—
16
 SCADA HMI N/A
pytm
Critical data-at-rest on server SCADA HMI is not encrypted, leading to severe information disclosure if compromised.
TK-BBF3EF22
1.00
CRITICAL (10.0)
D3F
—
17
 finance zone N/A
AI
(AI) Financial Data Exfiltration via Compromised Workstation: Workstations within the Finance Zone handle sensitive financial data without IDS/IPS protection or encryption-at-rest controls. An attacker who compromises a single finance workstation (via phishing or drive-by download) can directly access and exfiltrate stored financial databases, spreadsheets, and reporting files. The lack of monitoring allows the exfiltration to occur quietly over an extended period.
TK-BAFEDC1C
0.90
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (4)
  • File integrity monitoring on Finance Zone workstations
  • Endpoint DLP (Data Loss Prevention) exit point logs
  • Outbound network traffic content inspection logs
  • Finance application access audit logs with data element classification
SIEM rules (2)
Finance database access from unexpected processes
ProcessName NOT IN (*sqlservr.exe, *finance_app.exe) AND DatabaseAccess IN (FinanceDB) AND User NOT IN (finance_team)
Outbound data transfer from finance workstations
OutboundTCPConnection FROM finance_workstation TO external_ip AND DataVolume > 100MB within 1h
IOCs (3)
  • Known finance malware C2 domain patterns (e.g., *.financedata-exfil[.]com)
  • Process names: mimikatz, gsecdump, lazarus* associated with finance processes
  • Encoded PowerShell commands base64 decoding to finance-related strings
18
 External Attacker → CI CD Pipeline → Core Database Cluster → Developer N/A
LLM
(RAG-LLM) Cloud Credential Harvest via Phishing and Kubernetes Pivot: An external attacker conducts a phishing campaign targeting cloud credentials (leveraging the reported increased phishing attacks). Successful credential theft allows the attacker to authenticate to the AWS console and gain access to the Kubernetes cluster. From there, the attacker exploits the CI/CD pipeline dataflow (DevToCICD, GitLabToCICD) to inject malicious code or deploy rogue pods. This provides initial foothold inside the trust boundary. The attacker then pivots to the Core Database Cluster (CICDToCoreDB dataflow) to exfiltrate sensitive customer data and payment information, leveraging known PostgreSQL vulnerabilities for versions older than 14.x that are being actively exploited.
TK-0DD234C9
0.92
CRITICAL (10.0)
⛔D3F
—
19
 Primary Domain Controller N/A
pytm
Insecure security configuration or hardening on Primary Domain Controller leading to information exposure
TK-01D9584C
1.00
CRITICAL (9.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
20
 Financial ERP System N/A
AI
(AI) Financial ERP Database Direct SQL Injection via Internal Network Access: The Financial ERP System runs on a physical machine with no encryption at rest and no network controls (WAF/IPS). The database listens on the internal network with credentials transmitted in cleartext from the Jump Server and Finance Workstations. An attacker who gains internal network access can send malformed SQL queries directly to the database, exfiltrating or modifying critical financial data.
TK-4488D94D
0.90
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
🔍 LOW
Missing logs (5)
  • Network Flow — Internal DNS queries from Finance Workstation to unknown domains
  • Network Flow — Unencrypted LDAP queries (port 389) from internal hosts to Domain Controllers
  • Firewall/IPS — Outbound traffic from internal network to database ports (TCP/1433, TCP/5432) from non-application hosts
  • Database audit logs — Failed login attempts and successful logins to Financial ERP database
  • EDR — Process execution events showing sqlmap, sqlplus, or similar tools on Finance Workstation
SIEM rules (2)
Unencrypted LDAP query from internal host to DC
EventID=5156 AND Protocol=LDAP AND DestinationPort=389 AND SourceWorkstation NOT IN (FinanceWorkstation, AppServer)
Database port access from internal workstation
NetworkFlow AND DestinationPort IN (1433, 5432, 3306) AND Source NOT IN (FinancialERPServer, AppTier) AND Time > 08:00 AND Time < 18:00
IOCs (3)
  • Process names: 'sqlplus', 'sqlcmd', 'psql' with internal network source
  • Command lines: containing 'SELECT * FROM customers', 'EXEC xp_dirtree', 'sp_makewebtask'
  • Outbound connections from workstation to database IP on non-standard ports
21
 Financial ERP System N/A
pytm
Insecure security configuration or hardening on Financial ERP System leading to information exposure
TK-2FFBF7BB
1.00
HIGH (8.8)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
22
 Core Database Cluster N/A
pytm
Insecure security configuration or hardening on Core Database Cluster leading to information exposure
TK-62D40E19
1.00
HIGH (8.8)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
23
 Source Code Repository N/A
AI
(AI) Source Code Repository Unauthorized Access and Code Theft: The Source Code Repository is hosted on a Linux virtual machine with GitLab/Git and no WAF/IPS protection. Authentication relies on two-factor over SSH, but if an attacker compromises a Developer workstation or obtains valid SSH keys (including potentially stored or weakly protected keys), they can clone, download, and exfiltrate the entire proprietary codebase, including critical manufacturing IP and logic.
TK-058B4DA9
0.90
CRITICAL (9.5)
D3F
🔍 MEDIUM
Missing logs (5)
  • EDR — SSH key access events and token export from Developer workstation
  • File Integrity Monitoring — SSH authorized_keys file modifications on Developer workstation
  • Network Flow — Outbound SSH connections from Developer workstation to Source Code Repository
  • SIEM — Successful SSH authentication events from Developer workstation to Repository
  • Cloud Security — API-based alerts for suspicious GitLab/GitHub token usage
SIEM rules (2)
SSH private key export from Developer workstation
FileCreate AND DestinationPath MATCHES '.ssh/id_*' AND SourceWorkstation = DeveloperWorkstation AND User != 'developer_user'
Successful SSH authentication to Source Code Repository from unexpected source
EventID=22 AND Service=SSH AND SourceIp NOT IN (DeveloperWorkstationIP, CI_CD_Pipeline_IP) AND count > 3 within 1h
IOCs (3)
  • Process names: 'putty', 'plink', 'ssh' with unusual arguments (-N, -R, -D) from Developer workstation
  • File modifications: authorized_keys or id_rsa/ed25519 files changed recently on Developer workstation
  • Token patterns: GitLab personal access tokens or GitHub PATs found in process environment variables
24
 ExternalToRouter N/A
pytm
Data interception on an unencrypted channel from External Attacker to Edge Router (Man-in-the-Middle attack)
TK-4D1C50B4
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
25
 ExternalToMail N/A
pytm
Data interception on an unencrypted channel from External Attacker to Mail Gateway (Man-in-the-Middle attack)
TK-AC6C417B
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
26
 RouterToWAF N/A
pytm
Data interception on an unencrypted channel from Edge Router to Web Application Firewall (Man-in-the-Middle attack)
TK-2D08C0ED
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
27
 WAFToProxy N/A
pytm
Data interception on an unencrypted channel from Web Application Firewall to Reverse Proxy (Man-in-the-Middle attack)
TK-94A0EC87
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
28
 ProxyToInternalFW N/A
pytm
Data interception on an unencrypted channel from Reverse Proxy to Internal Firewall (Man-in-the-Middle attack)
TK-4058B48E
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
29
 MailToWorkstation N/A
pytm
Data interception on an unencrypted channel from Mail Gateway to Employee Workstation (Man-in-the-Middle attack)
TK-09F1EF9A
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
30
 InternalFWToWorkstation N/A
pytm
Data interception on an unencrypted channel from Internal Firewall to Employee Workstation (Man-in-the-Middle attack)
TK-7305194D
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
31
 EmployeeToWorkstation N/A
pytm
Data interception on an unencrypted channel from Corporate Employee to Employee Workstation (Man-in-the-Middle attack)
TK-D8E9DF95
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
32
 WorkstationToAD N/A
pytm
Data interception on an unencrypted channel from Employee Workstation to Primary Domain Controller (Man-in-the-Middle attack)
TK-31780AE0
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
33
 WorkstationToFile N/A
pytm
Data interception on an unencrypted channel from Employee Workstation to File Server (Man-in-the-Middle attack)
TK-412A7C27
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
34
 WorkstationToSIEM N/A
pytm
Data interception on an unencrypted channel from Employee Workstation to SIEM Server (Man-in-the-Middle attack)
TK-682B5A03
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
35
 ADToBackupAD N/A
pytm
Data interception on an unencrypted channel from Primary Domain Controller to Backup Domain Controller (Man-in-the-Middle attack)
TK-134795E3
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
36
 SIEMToAD N/A
pytm
Data interception on an unencrypted channel from SIEM Server to Primary Domain Controller (Man-in-the-Middle attack)
TK-ABEC074B
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
37
 JumpToSCADA N/A
pytm
Data interception on an unencrypted channel from Jump Server to SCADA HMI (Man-in-the-Middle attack)
TK-CE326BC6
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
38
 JumpToERP N/A
pytm
Data interception on an unencrypted channel from Jump Server to Financial ERP System (Man-in-the-Middle attack)
TK-85C4001A
1.00
HIGH (8.4)
NET D3F
—
39
 FinanceEmpToERP N/A
pytm
Data interception on an unencrypted channel from Finance Employee to Financial ERP System (Man-in-the-Middle attack)
TK-4845CB73
1.00
HIGH (8.4)
NET D3F
—
40
 ERPToCoreDB N/A
pytm
Data interception on an unencrypted channel from Financial ERP System to Core Database Cluster (Man-in-the-Middle attack)
TK-DE28B340
1.00
HIGH (8.4)
NET D3F
—
41
 CICDToCoreDB N/A
pytm
Data interception on an unencrypted channel from CI CD Pipeline to Core Database Cluster (Man-in-the-Middle attack)
TK-206BA1DD
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
42
 CoreDBToBackup N/A
pytm
Data interception on an unencrypted channel from Core Database Cluster to Backup Server (Man-in-the-Middle attack)
TK-1F3DCE45
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
43
 SCADAOpToHMI N/A
pytm
Data interception on an unencrypted channel from SCADA Operator to SCADA HMI (Man-in-the-Middle attack)
TK-0B975EB1
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
44
 HMIToPLC N/A
pytm
Data interception on an unencrypted channel from SCADA HMI to PLC Controller (Man-in-the-Middle attack)
TK-0AD34ECF
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
45
 InternalDNSToAD N/A
pytm
Data interception on an unencrypted channel from Internal DNS Server to Primary Domain Controller (Man-in-the-Middle attack)
TK-B23A0E1F
1.00
HIGH (8.4)
NET D3F
  • No specific OWASP mitigations found.
—
46
 PKI Certificate Authority N/A
pytm
Insecure security configuration or hardening on PKI Certificate Authority leading to information exposure
TK-C97D1DC6
1.00
HIGH (8.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
47
 SCADA HMI N/A
pytm
Insecure security configuration or hardening on SCADA HMI leading to information exposure
TK-19C92BD1
1.00
HIGH (8.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
48
 PLC Controller N/A
pytm
Insecure security configuration or hardening on PLC Controller leading to information exposure
TK-B7533197
1.00
HIGH (8.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
49
 Corporate Employee → Finance Employee → Finance ERP System → Core Database Cluster N/A
LLM
(RAG-LLM) Insider Data Exfiltration via ERP and Core Database: A malicious Corporate Employee or Finance Employee leverages their legitimate access to the Finance ERP System and Core Database Cluster. By abusing FinanceEmpToERP and ERPToCoreDB dataflows, the insider can query, modify, or exfiltrate sensitive customer and payment data. The insider may also leverage the CI/CD pipeline access (Developer role) to escalate privileges or plant persistent backdoors within the Core Database Cluster, capitalizing on the insider threat concern and the sensitive nature of the data stored.
TK-DB1EC13A
0.78
CRITICAL (9.9)
⛔D3F
  • No specific OWASP mitigations found.
—
50
 dmz N/A
AI
(AI) Unprotected DMZ Services Enumeration: The DMZ hosts network-facing services without documented security controls (WAF, IDS, IPS). An attacker can perform reconnaissance by scanning open ports and enumerating service banners, potentially identifying vulnerable applications or misconfigurations that serve as entry points into the internal network.
TK-19F45607
0.90
HIGH (8.2)
NET D3F
🔍 MEDIUM
Missing logs (4)
  • DNS proxy logs — queries forwarded from internal DNS to external resolvers
  • Internal DNS server logs — query logs with source workstation identification
  • Network segmentation logs — DMZ DNS server configuration and allowed queries
  • Endpoint DNS resolution logs — local cache contents from internal hosts
SIEM rules (2)
DMZ DNS server receiving queries for internal hostnames not in its zone
dns_query AND dns_query_name contains ".internal" OR dns_query_name contains ".corp" AND dns_server=dmz_dns AND query_type=AXFR OR query_type=ANY
Internal hosts querying DMZ DNS server for internal resolution
dns_query AND source_zone=internal AND dest_zone=dmz AND dns_query_name NOT in (dmz_service_names)
IOCs (3)
  • DNS queries for internal hostnames from DMZ-resident services
  • Zone transfer requests (AXFR) to DMZ DNS server from internal sources
  • Service banners from DMZ hosts revealing internal network structure in error responses
51
 Edge Router N/A
pytm
Insecure security configuration or hardening on Edge Router leading to information exposure
TK-C51B6F57
1.00
MEDIUM (7.0)
NET D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
52
 Web Application Firewall N/A
pytm
Insecure security configuration or hardening on Web Application Firewall leading to information exposure
TK-C5E1158F
1.00
MEDIUM (7.0)
NET D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
53
 Reverse Proxy N/A
pytm
Insecure security configuration or hardening on Reverse Proxy leading to information exposure
TK-7EEA6711
1.00
MEDIUM (7.0)
NET D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
54
 Mail Gateway N/A
pytm
Insecure security configuration or hardening on Mail Gateway leading to information exposure
TK-2F79B9B8
1.00
MEDIUM (7.0)
NET D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
55
 Corporate VPN Gateway N/A
pytm
Insecure security configuration or hardening on Corporate VPN Gateway leading to information exposure
TK-E0ED7B45
1.00
MEDIUM (7.0)
NET D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
56
 Remote Employee N/A
AI
(AI) Unencrypted VPN Tunnel Data Interception: Although the VPN tunnel is IPsec-encrypted, misconfiguration or downgrade attacks could expose sensitive manufacturing data in transit, including production schedules and proprietary process data.
TK-1E4F5411
0.90
HIGH (7.6)
NET D3F
🔍 LOW
Missing logs (3)
  • IPsec tunnel encryption status and negotiation logs
  • Network flow logs with TLS version and cipher suite negotiation data
  • VPN gateway configuration diff logs showing parameter changes
SIEM rules (2)
VPN tunnel encryption downgrade attempt
EventID=IPSEC_NEGOTIATE AND CipherSuite=~DES|3DES AND NegotiateResult=fail
Unusual VPN traffic pattern indicating potential interception
NetworkFlow AND Protocol=TCP AND Duration > 3600 AND ByteCount < 100 FROM VPN_gateway
IOCs (3)
  • IPsec SA parameters indicating weak or null encryption (null encryption flag, weak PFS group)
  • ARP spoofing or BGP hijacking indicators near VPN gateway network segment
  • TLS certificate validation errors in VPN client logs
57
 internal network N/A
AI
(AI) Unencrypted Sensitive Data in Transit Across Internal Network: The Internal Network trust boundary transmits data without encryption, and with no IDS/IPS to detect leakage. Applications or services transferring confidential data (e.g., financial records, personal identifiers) across the internal network expose that data to any compromised host or insider. An attacker with foothold on any internal machine can sniff traffic and exfiltrate sensitive information.
TK-8F5CFE2C
0.90
HIGH (7.6)
NET D3F
🔍 LOW
Missing logs (3)
  • Network flow logs with payload inspection capability
  • Endpoint firewall auditd or Windows Filtering Platform logs for promiscuous mode
  • Network segmentation logs showing traffic flow between zones
SIEM rules (2)
Promiscuous mode network adapter detection
EventID=8023 AND PromiscuousMode=TRUE AND Interface NOT in (management_vlans)
Unencrypted sensitive file transfers
SMB traffic on port 445 FROM workstation TO workstation AND NOT SMB signing enabled
IOCs (3)
  • Wireshark or tshark process execution
  • Network capture drivers loaded (e.g., \Device\NPF_*)
  • Outbound TCP connections from workstations to external IPs without TLS handshake indicators
58
 Internal DNS Server N/A
AI
(AI) DNS Zone Transfer Without Restrictions: The internal DNS server allows unrestricted zone transfers to any querying client. An attacker can extract the complete DNS zone database, revealing internal hostnames, IP addressing schemes, and network topology information useful for further reconnaissance.
TK-926AC931
0.90
HIGH (7.5)
D3F
🔍 MEDIUM
Missing logs (3)
  • DNS server query logs with AXFR flag and source IP tracking
  • DNS server configuration showing allowed transfer sources
  • Network DNS traffic logs capturing zone transfer attempts
SIEM rules (2)
DNS zone transfer request detected
dns_query_logs and query_type=AXFR and source_ip not in allowed_transfer_servers
DNS server responding to zone transfers from external IPs
dns_query_logs and query_type=AXFR and source_ip in external_ip_ranges
IOCs (3)
  • DNS query strings containing 'AXFR' or 'CHAOS' class requests
  • Source IPs attempting zone transfers that are not designated secondary DNS servers
  • Unusual DNS query patterns from compromised internal hosts
59
 File Server N/A
AI
(AI) SMB Share Enumeration and Data Exfiltration: The file server hosts SMB shares without authentication. An attacker with network access can enumerate share names and access stored files, exfiltrating confidential financial data and proprietary IP.
TK-7241C235
0.90
MEDIUM (7.4)
⛔D3F
  • No specific D3FEND mitigations found.
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (3)
  • File server audit logs for SMB share access events
  • SMB protocol logs capturing file read/write operations
  • Network segmentation logs showing workstation to file server connectivity
SIEM rules (2)
SMB share enumeration from external or unexpected source
smb_logs and (event_type='net_view' OR event_type='enum4linux') and source_ip not in file_server_trusted_networks
SMB file read/write from workstation to file server outside business hours
smb_logs and file_access_event and source_workstation not in approved_admin_workstations and event_time outside business_hours
IOCs (3)
  • SMB client tool signatures (enum4linux,responder,smbclient) in network logs
  • File server SMB shares with 'Everyone' or 'Authenticated Users' full control permissions
  • Outbound SMB connections from workstations to file server IPs not in expected subnet
60
 internet N/A
AI
(AI) Unfiltered DNS Queries Exposing Internal Topology: The on-premises network allows unfiltered DNS queries from internal hosts to external resolvers, potentially revealing internal hostnames, service names, and network topology to external parties. This reconnaissance aids future targeted attacks.
TK-BAD97C30
0.90
MEDIUM (7.0)
NET D3F
🔍 MEDIUM
Missing logs (4)
  • DNS query logs from internal hosts — destination resolver and query type
  • DNS firewall or resolver logs — queries for internal hostnames from internal sources
  • Network flow logs — DNS query volume and patterns per host
  • Endpoint DNS cache — local resolver cache contents from compromised hosts
SIEM rules (2)
Internal hosts querying external DNS resolvers for internal hostnames
dns_query AND dns_query_name contains ".internal" OR dns_query_name contains ".local" AND source_ip in internal_subnet AND resolver NOT in (approved_resolvers)
High volume of DNS queries from single internal host
dns_query AND source_ip=single_host AND count > 1000 within 1h AND query_name NOT in (common_internals)
IOCs (3)
  • DNS query patterns for internal naming conventions: hostname.domain.local, servername.internal
  • Query types: AXFR (zone transfers) or ANY requests from internal hosts
  • Internal hostnames appearing in external DNS resolver logs
61
 Internal Firewall N/A
pytm
Insecure security configuration or hardening on Internal Firewall leading to information exposure
TK-98DBAC06
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
62
 Internal DNS Server N/A
pytm
Insecure security configuration or hardening on Internal DNS Server leading to information exposure
TK-5932E206
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
63
 Employee Workstation N/A
pytm
Insecure security configuration or hardening on Employee Workstation leading to information exposure
TK-793AD8CB
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
64
 File Server N/A
pytm
Insecure security configuration or hardening on File Server leading to information exposure
TK-8A18C6A8
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
65
 Backup Domain Controller N/A
pytm
Insecure security configuration or hardening on Backup Domain Controller leading to information exposure
TK-538E8062
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
66
 SIEM Server N/A
pytm
Insecure security configuration or hardening on SIEM Server leading to information exposure
TK-D6F81549
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
67
 Jump Server N/A
pytm
Insecure security configuration or hardening on Jump Server leading to information exposure
TK-B135EBA6
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
68
 Finance Workstation N/A
pytm
Insecure security configuration or hardening on Finance Workstation leading to information exposure
TK-35412751
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
69
 Source Code Repository N/A
pytm
Insecure security configuration or hardening on Source Code Repository leading to information exposure
TK-C0D9D98B
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
70
 CI CD Pipeline N/A
pytm
Insecure security configuration or hardening on CI CD Pipeline leading to information exposure
TK-D590F81C
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
71
 Backup Server N/A
pytm
Insecure security configuration or hardening on Backup Server leading to information exposure
TK-FD3A05C5
1.00
MEDIUM (6.3)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
72
 Corporate Employee N/A
AI
(AI) Unsecured RDP Session to Employee Workstation: The corporate employee authenticates to their workstation via RDP with only credentials; without network-Level Authentication (NLA) or session encryption enforcement, an adjacent attacker can intercept or hijack the session.
TK-3404D695
0.90
MEDIUM (6.9)
D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (3)
  • RDP session logs with Network Level Authentication (NLA) status
  • Network traffic logs capturing RDP traffic encryption status
  • Workstation firewall rules enforcing RDP access restrictions
SIEM rules (2)
RDP session establishment without NLA
EventID=RDP_SESSION AND NLAStatus=absent AND SourceIP=~internal_subnet
RDP traffic from non-admin workstation to workstation
EventID=RDP_CONNECT AND SourceUser!~admin_group AND DestinationProcess=~workstation AND Protocol=TCP AND DestinationPort=3389
IOCs (3)
  • RDP listener (3389) exposed to internal network without NLA enforcement
  • Process creation events for mstsc.exe from unexpected source processes
  • Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections
73
 IT Administrator N/A
AI
(AI) Jump Server Session Interception and Credential Theft: The IT administrator's RDP session to the jump server, while encrypted, could be intercepted if the encryption is downgraded or if the administrator connects from a compromised endpoint, exposing privileged credentials and session tokens.
TK-9FEFBF96
0.90
MEDIUM (6.9)
D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (3)
  • RDP traffic encryption and integrity monitoring logs
  • Network path monitoring for MITM indicators between administrator endpoint and jump server
  • Jump server session recording and playback logs
SIEM rules (2)
RDP session from compromised administrator endpoint
EventID=RDP_CONNECT AND SourceWorkstation=~compromised_endpoint AND User=~it_admin AND DestinationHost=~jump_server
Atypical RDP session duration or data transfer volume
EventID=RDP_SESSION AND Duration > 43200 AND ByteCount > 500MB FROM SourceWorkstation=~admin_endpoint
IOCs (3)
  • RDP session initiation from administrator endpoint known to be compromised or infected
  • Abnormal RDP data transfer volumes during typical administrative sessions
  • Network MITM tools or proxy configurations between admin endpoint and jump server network
74
 Developer N/A
AI
(AI) Developer Source Code Credential Leakage via CI/CD Pipeline: The developer's two-factor authenticated session may be compromised through phishing or infostealer malware, leading to exposure of CI/CD pipeline credentials, API tokens, and source code repositories. The lack of WAF/IDS/IPS on the developer workstation and the encrypted SSH/HTTPS channels being vulnerable to man-in-the-middle if endpoint security is bypassed.
TK-A90918ED
0.90
MEDIUM (6.9)
D3F
🔍 MEDIUM
Missing logs (4)
  • EDR telemetry — process creation events for git, curl, wget, or ssh from developer workstations
  • File integrity monitoring — changes to CI/CD pipeline configuration files
  • Cloud access security broker (CASB) logs — anomalous API token usage
  • SIEM logs — source code repository commit events with associated user agents
SIEM rules (2)
Anomalous git or SSH activity from developer workstation
ProcessCommandLine|contains:\"git push\" OR ProcessCommandLine|contains:\"ssh-add\" FROM User=Developer AND NOT Timeframe=Business_Hours
CI/CD pipeline credential materialization events
EventID=4663 AND TargetObject LIKE "*credentials*" OR TargetObject LIKE "*token*" OR TargetObject LIKE "*SSH*"
IOCs (3)
  • Domain patterns associated with developer's corporate SSO used outside expected geographies
  • CI/CD service account API tokens found in public git repositories or paste sites
  • SSH keys matching developer's workstation found on non-corporate infrastructure
75
 SCADA Operator N/A
AI
(AI) SCADA HMI Operational Data Interception and Exfiltration: The RDP connection from the SCADA Operator to the HMI lacks specified encryption at rest or in transit controls in the component definition. If the RDP session is intercepted (e.g., via network sniffing on the internal segment or compromised switch), sensitive operational data, process variables, and system configurations can be exfiltrated, revealing proprietary IP and process weaknesses.
TK-83A46B0E
0.90
MEDIUM (6.9)
D3F
🔍 MEDIUM
Missing logs (5)
  • Network flow logs — OT VLAN traffic analysis and anomaly detection
  • Wireless network monitoring — unauthorized devices on OT SCADA VLAN
  • IDS/IPS logs — RDP session hijacking signatures or network sniffing alerts
  • SIEM logs — RDP protocol anomalies or TLS handshake failures in OT environment
  • Endpoint detection — screen capture or video recording processes on HMI workstation
SIEM rules (2)
RDP session interception indicators from OT VLAN
NetworkFlow|DestinationPort=3389 AND SourceVLAN=OT_SCADA_VLAN AND NOT DestinationIP=SCADA_HMI_IP
Unusual RDP protocol metadata or TLS anomalies
SIEM_Protocol_Logs|Protocol=RDP AND (Handshake_Failure OR Anomalous_TLS_Cipher)
IOCs (3)
  • MAC addresses of unauthorized switches or rogue access points on OT SCADA VLAN
  • Domain names or IP ranges associated with known network sniffing tools
  • TLS certificates used in RDP sessions that do not match the SCADA HMI hostname
76
 Employee Workstation N/A
AI
(AI) Local File Exposure of Stored Credentials and Browser Data: The workstation stores credentials locally for RDP and SMB connections, and browsers store session cookies and passwords without encryption at rest. If an attacker gains access to the workstation filesystem (e.g., via malware or physical access), they can extract stored passwords, API keys, and session tokens, leading to compromise of connected services.
TK-AAFB2778
0.90
MEDIUM (6.9)
D3F
🔍 HIGH
Missing logs (3)
  • Endpoint detection and response (EDR) logs for credential access patterns
  • Windows Security Event 4663 — file access to credential files
  • Process creation logs showing lsass.exe or credential manager access
SIEM rules (2)
Credential file access from non-system processes
file_access_events and target_path contains ('ntds.dit','sam','credman','browser') and process_name not in ('svchost.exe','lsass.exe','explorer.exe')
Browser profile directory access by suspicious processes
file_access_events and target_path ends with ('Cookies','Login Data','History') and process_name not in ('chrome.exe','firefox.exe','edge.exe')
IOCs (3)
  • Process names like 'procdump','gsecdump','mimikatz' accessing credential stores
  • Registry key access: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CredentialManager
  • Unusual child processes of explorer.exe or svchost.exe accessing user profile directories
77
 Web Application Firewall N/A
AI
(AI) WAF Debug Mode Exposure of Internal Architecture: If the Web Application Firewall is accidentally or misconfigured to run in debug mode, it may output detailed error messages, internal path information, and ModSecurity rule debugging data. An attacker exploiting this can learn the internal architecture, backend server addresses, and potentially the source code or framework versions in use, facilitating more targeted subsequent attacks.
TK-EB39D65A
0.90
LOW (5.8)
NET D3F
🔍 MEDIUM
Missing logs (5)
  • Web Application Firewall access and error logs — verbose output capture
  • Reverse proxy access logs — request and response metadata
  • SIEM logs — ModSecurity rule execution events with severity levels
  • Network IDS logs — HTTP requests designed to trigger error conditions
  • Application firewall debug mode status change alerts
SIEM rules (2)
WAF debug mode configuration change
Firewall_Config_Logs|Component=WAF AND Field=Debug_Mode AND Value=Enabled AND Change_Type=Modify
WAF verbose error output in HTTP responses
HTTP_Response|Status=5xx AND Response_Body|contains:\"file path\" OR Response_Body|contains:\"server version\" OR Response_Body|contains:\"ModSecurity\"
IOCs (3)
  • HTTP headers typically triggering WAF debug output (e.g., X-Forwarded-For with malformed values)
  • URL patterns known to elicit detailed error responses from specific WAF vendors
  • Error message snippets found in threat intelligence feeds related to WAF misconfigurations
# Target Business Value Source Description Conf. CVEs Severity Risk Signals CAPEC MITRE Techniques MITRE Mitigations D3FEND Mitigations CIS Mitigations NIST Mitigations OWASP Mitigations Detection (SOC)
1
 Primary Domain Controller N/A
pytm
Lack of monitoring or logging on Primary Domain Controller, preventing detection of malicious activities and enabling repudiation
TK-F5A60647
1.00
CRITICAL (9.9)
D3F
—
2
 Financial ERP System N/A
pytm
Lack of monitoring or logging on Financial ERP System, preventing detection of malicious activities and enabling repudiation
TK-579B78FC
1.00
CRITICAL (9.4)
D3F
—
3
 Core Database Cluster N/A
pytm
Lack of monitoring or logging on Core Database Cluster, preventing detection of malicious activities and enabling repudiation
TK-1B273EA0
1.00
CRITICAL (9.4)
D3F
—
4
 PKI Certificate Authority N/A
pytm
Lack of monitoring or logging on PKI Certificate Authority, preventing detection of malicious activities and enabling repudiation
TK-0E9F78BF
1.00
HIGH (8.9)
D3F
—
5
 SCADA HMI N/A
pytm
Lack of monitoring or logging on SCADA HMI, preventing detection of malicious activities and enabling repudiation
TK-76FF33FC
1.00
HIGH (8.9)
D3F
—
6
 PLC Controller N/A
pytm
Lack of monitoring or logging on PLC Controller, preventing detection of malicious activities and enabling repudiation
TK-EDEF06D0
1.00
HIGH (8.9)
D3F
—
7
 Edge Router N/A
pytm
Lack of monitoring or logging on Edge Router, preventing detection of malicious activities and enabling repudiation
TK-4D44AADE
1.00
HIGH (7.6)
NET D3F
—
8
 Web Application Firewall N/A
pytm
Lack of monitoring or logging on Web Application Firewall, preventing detection of malicious activities and enabling repudiation
TK-ADF44B6A
1.00
HIGH (7.6)
NET D3F
—
9
 Reverse Proxy N/A
pytm
Lack of monitoring or logging on Reverse Proxy, preventing detection of malicious activities and enabling repudiation
TK-69E0386B
1.00
HIGH (7.6)
NET D3F
—
10
 Mail Gateway N/A
pytm
Lack of monitoring or logging on Mail Gateway, preventing detection of malicious activities and enabling repudiation
TK-E4AECA13
1.00
HIGH (7.6)
NET D3F
—
11
 Corporate VPN Gateway N/A
pytm
Lack of monitoring or logging on Corporate VPN Gateway, preventing detection of malicious activities and enabling repudiation
TK-B8B730CF
1.00
HIGH (7.6)
NET D3F
—
12
 External Attacker N/A
pytm
Repudiation of critical actions performed by External Attacker due to insufficient logging or non-repudiation controls
TK-6C2D6281
1.00
MEDIUM (7.0)
NET D3F
—
13
 Remote Employee N/A
pytm
Repudiation of critical actions performed by Remote Employee due to insufficient logging or non-repudiation controls
TK-66A27BDD
1.00
MEDIUM (7.0)
NET D3F
—
14
 Internal Firewall N/A
pytm
Lack of monitoring or logging on Internal Firewall, preventing detection of malicious activities and enabling repudiation
TK-F9B544F8
1.00
MEDIUM (6.9)
D3F
—
15
 Internal DNS Server N/A
pytm
Lack of monitoring or logging on Internal DNS Server, preventing detection of malicious activities and enabling repudiation
TK-6EC4F5C8
1.00
MEDIUM (6.9)
D3F
—
16
 Employee Workstation N/A
pytm
Lack of monitoring or logging on Employee Workstation, preventing detection of malicious activities and enabling repudiation
TK-253FFF44
1.00
MEDIUM (6.9)
D3F
—
17
 File Server N/A
pytm
Lack of monitoring or logging on File Server, preventing detection of malicious activities and enabling repudiation
TK-2772F6F5
1.00
MEDIUM (6.9)
D3F
—
18
 Backup Domain Controller N/A
pytm
Lack of monitoring or logging on Backup Domain Controller, preventing detection of malicious activities and enabling repudiation
TK-A745A79A
1.00
MEDIUM (6.9)
D3F
—
19
 SIEM Server N/A
pytm
Lack of monitoring or logging on SIEM Server, preventing detection of malicious activities and enabling repudiation
TK-8DE9EEBE
1.00
MEDIUM (6.9)
D3F
—
20
 Jump Server N/A
pytm
Lack of monitoring or logging on Jump Server, preventing detection of malicious activities and enabling repudiation
TK-524925EE
1.00
MEDIUM (6.9)
D3F
—
21
 Finance Workstation N/A
pytm
Lack of monitoring or logging on Finance Workstation, preventing detection of malicious activities and enabling repudiation
TK-C2FE6770
1.00
MEDIUM (6.9)
D3F
—
22
 Source Code Repository N/A
pytm
Lack of monitoring or logging on Source Code Repository, preventing detection of malicious activities and enabling repudiation
TK-E0DBD686
1.00
MEDIUM (6.9)
D3F
—
23
 CI CD Pipeline N/A
pytm
Lack of monitoring or logging on CI CD Pipeline, preventing detection of malicious activities and enabling repudiation
TK-8207EF98
1.00
MEDIUM (6.9)
D3F
—
24
 Backup Server N/A
pytm
Lack of monitoring or logging on Backup Server, preventing detection of malicious activities and enabling repudiation
TK-5284534C
1.00
MEDIUM (6.9)
D3F
—
25
 Corporate Employee N/A
pytm
Repudiation of critical actions performed by Corporate Employee due to insufficient logging or non-repudiation controls
TK-06236051
1.00
MEDIUM (6.3)
D3F
—
26
 Finance Employee N/A
pytm
Repudiation of critical actions performed by Finance Employee due to insufficient logging or non-repudiation controls
TK-18B528B3
1.00
MEDIUM (6.3)
D3F
—
27
 IT Administrator N/A
pytm
Repudiation of critical actions performed by IT Administrator due to insufficient logging or non-repudiation controls
TK-D4BD4A7A
1.00
MEDIUM (6.3)
D3F
—
28
 Developer N/A
pytm
Repudiation of critical actions performed by Developer due to insufficient logging or non-repudiation controls
TK-C6028396
1.00
MEDIUM (6.3)
D3F
—
29
 SCADA Operator N/A
pytm
Repudiation of critical actions performed by SCADA Operator due to insufficient logging or non-repudiation controls
TK-2DF55155
1.00
MEDIUM (6.3)
D3F
—
# Target Business Value Source Description Conf. CVEs Severity Risk Signals CAPEC MITRE Techniques MITRE Mitigations D3FEND Mitigations CIS Mitigations NIST Mitigations OWASP Mitigations Detection (SOC)
1
 Web Application Firewall N/A
pytm
Firewall rule misconfiguration allowing unintended traffic to bypass Web Application Firewall and reach internal networks
TK-11D583C8
1.00
CRITICAL (10.0)
NET ⛔D3F
  • No specific MITRE mitigations found.
  • No specific D3FEND mitigations found.
  • No specific CIS mitigations found.
  • No specific NIST mitigations found.
  • No specific OWASP mitigations found.
—
2
 Edge Router N/A
pytm
Firewall rule misconfiguration allowing unintended traffic to bypass Edge Router and reach internal networks
TK-CBC73AA0
1.00
CRITICAL (10.0)
NET D3F
—
3
 ProxyToInternalFW N/A
pytm
Potential for spoofing attacks on data crossing trust boundaries from Reverse Proxy to Internal Firewall without proper authentication
TK-ECF8AA3F
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
4
 ProxyToInternalFW N/A
pytm
Spoofing risk on dataflow from Reverse Proxy to Internal Firewall as it crosses a trust boundary with no authentication.
TK-76DBD5DA
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
5
 MailToWorkstation N/A
pytm
Potential for spoofing attacks on data crossing trust boundaries from Mail Gateway to Employee Workstation without proper authentication
TK-1B468CE8
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
6
 MailToWorkstation N/A
pytm
Spoofing risk on dataflow from Mail Gateway to Employee Workstation as it crosses a trust boundary with no authentication.
TK-C91A6E39
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
7
 VPNToInternalFW N/A
pytm
Potential for spoofing attacks on data crossing trust boundaries from Corporate VPN Gateway to Internal Firewall without proper authentication
TK-69E90788
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
8
 Internal Firewall N/A
pytm
Firewall rule misconfiguration allowing unintended traffic to bypass Internal Firewall and reach internal networks
TK-10BC37EE
1.00
CRITICAL (9.7)
D3F
—
9
 Corporate Employee N/A
pytm
Actor Corporate Employee uses single-factor authentication (credentials only), increasing risk from phishing and credential stuffing.
TK-12DDE587
1.00
CRITICAL (9.7)
D3F
—
10
 Finance Employee N/A
pytm
Actor Finance Employee uses single-factor authentication (credentials only), increasing risk from phishing and credential stuffing.
TK-C47509AC
1.00
CRITICAL (9.7)
D3F
—
11
 SCADA Operator N/A
pytm
Actor SCADA Operator uses single-factor authentication (credentials only), increasing risk from phishing and credential stuffing.
TK-91E70752
1.00
CRITICAL (9.7)
D3F
—
12
 ExternalToRouter N/A
pytm
Spoofing of data from External Attacker to Edge Router due to lack of authentication
TK-73489AF9
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
13
 RemoteToVPN N/A
pytm
Spoofing of data from Remote Employee to Corporate VPN Gateway due to lack of authentication
TK-4EA7EBDE
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
14
 ExternalToMail N/A
pytm
Spoofing of data from External Attacker to Mail Gateway due to lack of authentication
TK-EE3AF1E7
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
15
 RouterToWAF N/A
pytm
Spoofing of data from Edge Router to Web Application Firewall due to lack of authentication
TK-5F9F61B4
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
16
 WAFToProxy N/A
pytm
Spoofing of data from Web Application Firewall to Reverse Proxy due to lack of authentication
TK-F170F1A0
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
17
 ProxyToInternalFW N/A
pytm
Spoofing of data from Reverse Proxy to Internal Firewall due to lack of authentication
TK-110F7285
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
18
 MailToWorkstation N/A
pytm
Spoofing of data from Mail Gateway to Employee Workstation due to lack of authentication
TK-7F5A4744
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
19
 VPNToInternalFW N/A
pytm
Spoofing of data from Corporate VPN Gateway to Internal Firewall due to lack of authentication
TK-597788D9
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
20
 InternalFWToWorkstation N/A
pytm
Spoofing of data from Internal Firewall to Employee Workstation due to lack of authentication
TK-734DFE85
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
21
 EmployeeToWorkstation N/A
pytm
Spoofing of data from Corporate Employee to Employee Workstation due to lack of authentication
TK-2DB34E31
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
22
 WorkstationToAD N/A
pytm
Spoofing of data from Employee Workstation to Primary Domain Controller due to lack of authentication
TK-792E4CFB
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
23
 WorkstationToFile N/A
pytm
Spoofing of data from Employee Workstation to File Server due to lack of authentication
TK-50937A3D
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
24
 WorkstationToSIEM N/A
pytm
Spoofing of data from Employee Workstation to SIEM Server due to lack of authentication
TK-778C6023
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
25
 ADToBackupAD N/A
pytm
Spoofing of data from Primary Domain Controller to Backup Domain Controller due to lack of authentication
TK-D47F8CC0
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
26
 ADToPKI N/A
pytm
Spoofing of data from Primary Domain Controller to PKI Certificate Authority due to lack of authentication
TK-8B406D34
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
27
 SIEMToAD N/A
pytm
Spoofing of data from SIEM Server to Primary Domain Controller due to lack of authentication
TK-BF7DCC55
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
28
 ITAdminToJump N/A
pytm
Spoofing of data from IT Administrator to Jump Server due to lack of authentication
TK-2224D061
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
29
 JumpToAD N/A
pytm
Spoofing of data from Jump Server to Primary Domain Controller due to lack of authentication
TK-F6FF6AA3
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
30
 ADToJump N/A
pytm
Spoofing of data from Primary Domain Controller to Jump Server due to lack of authentication
TK-0C9C2DA0
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
31
 JumpToSCADA N/A
pytm
Spoofing of data from Jump Server to SCADA HMI due to lack of authentication
TK-2CB09D05
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
32
 JumpToERP N/A
pytm
Spoofing of data from Jump Server to Financial ERP System due to lack of authentication
TK-31330039
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
33
 FinanceEmpToERP N/A
pytm
Spoofing of data from Finance Employee to Financial ERP System due to lack of authentication
TK-D17F8CE1
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
34
 ERPToCoreDB N/A
pytm
Spoofing of data from Financial ERP System to Core Database Cluster due to lack of authentication
TK-F2C1C934
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
35
 DevToGitLab N/A
pytm
Spoofing of data from Developer to Source Code Repository due to lack of authentication
TK-6A6A4168
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
36
 DevToCICD N/A
pytm
Spoofing of data from Developer to CI CD Pipeline due to lack of authentication
TK-D59D912A
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
37
 GitLabToCICD N/A
pytm
Spoofing of data from Source Code Repository to CI CD Pipeline due to lack of authentication
TK-78A29336
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
38
 CICDToCoreDB N/A
pytm
Spoofing of data from CI CD Pipeline to Core Database Cluster due to lack of authentication
TK-6A898981
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
39
 CoreDBToBackup N/A
pytm
Spoofing of data from Core Database Cluster to Backup Server due to lack of authentication
TK-4C12911A
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
40
 SCADAOpToHMI N/A
pytm
Spoofing of data from SCADA Operator to SCADA HMI due to lack of authentication
TK-2C31BAD6
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
41
 HMIToPLC N/A
pytm
Spoofing of data from SCADA HMI to PLC Controller due to lack of authentication
TK-C6F91063
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
42
 InternalDNSToAD N/A
pytm
Spoofing of data from Internal DNS Server to Primary Domain Controller due to lack of authentication
TK-8BE178CF
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
43
 External Attacker N/A
pytm
Identity spoofing of the actor External Attacker via phishing or credential theft
TK-B278DF5C
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
44
 Remote Employee N/A
pytm
Identity spoofing of the actor Remote Employee via phishing or credential theft
TK-2D665DD3
1.00
CRITICAL (9.0)
NET D3F
  • No specific OWASP mitigations found.
—
45
 Reverse Proxy N/A
AI
(AI) Reverse Proxy Request Spoofing and Origin Server Access Bypass: The Reverse Proxy (nginx) sits between the DMZ and the Internal Firewall, handling HTTP traffic. If the nginx configuration does not enforce strict hostname validation or if HTTP header forwarding (e.g., X-Forwarded-For) is trusted blindly, an attacker can send spoofed requests with forged headers. This can trick the Internal Firewall or backend applications into accepting requests as trusted internal traffic, bypassing perimeter security controls and gaining unauthorized access to internal services.
TK-538294ED
0.90
CRITICAL (9.6)
NET D3F
  • No specific OWASP mitigations found.
—
46
 dmz N/A
AI
(AI) External IP Spoofing to Bypass Network Boundaries: An attacker sends packets with spoofed source IP addresses originating from within the internal network, making traffic appear legitimate as it traverses the DMZ. Since the DMZ lacks IDS/IPS and authentication controls, spoofed packets can be used to probe internal systems or conduct further attacks while masking the true origin.
TK-6D1B7173
0.90
CRITICAL (9.6)
NET D3F
  • No specific OWASP mitigations found.
🔍 LOW
Missing logs (4)
  • Network flow logs — source IP verification and spoofing detection
  • Ingress filtering logs — BCP 38 compliance at edge router
  • IDS/IPS alerts — spoofed source IP detection and suppression
  • Endpoint firewall logs — outbound traffic with unexpected source IP modification
SIEM rules (2)
Ingress filtering violation — egress traffic with internal source IP
network_flow AND source_ip in internal_subnet AND dest_ip NOT in internal_subnet AND ingress_interface=egress AND ip_protocol=tcp_udp
Multiple hosts sharing same source IP in egress traffic
network_flow AND count(source_ip) > 100 within 5m AND nat_translated=true
IOCs (3)
  • Traffic with source IP matching internal subnet but originating from external interface
  • Egress traffic with source IP not NAT'd or translated by edge router
  • IDS alerts for source IP address validation failures at DMZ perimeter
47
 Corporate Employee N/A
pytm
Identity spoofing of the actor Corporate Employee via phishing or credential theft
TK-77F1B9B5
1.00
HIGH (8.3)
D3F
  • No specific OWASP mitigations found.
—
48
 Finance Employee N/A
pytm
Identity spoofing of the actor Finance Employee via phishing or credential theft
TK-F3983016
1.00
HIGH (8.3)
D3F
  • No specific OWASP mitigations found.
—
49
 IT Administrator N/A
pytm
Identity spoofing of the actor IT Administrator via phishing or credential theft
TK-A85BD298
1.00
HIGH (8.3)
D3F
  • No specific OWASP mitigations found.
—
50
 Developer N/A
pytm
Identity spoofing of the actor Developer via phishing or credential theft
TK-F651CEC0
1.00
HIGH (8.3)
D3F
  • No specific OWASP mitigations found.
—
51
 SCADA Operator N/A
pytm
Identity spoofing of the actor SCADA Operator via phishing or credential theft
TK-5E336127
1.00
HIGH (8.3)
D3F
  • No specific OWASP mitigations found.
—
52
 Internal DNS Server N/A
AI
(AI) DNS Cache Poisoning via Internal Network Access: An attacker with internal network access sends fraudulent DNS responses to the internal DNS server, poisoning its cache. This allows redirection of internal traffic to attacker-controlled systems. The DNS server lacks cryptographic validation (DNSSEC) and operates without authentication, making it susceptible to spoofed responses.
TK-99A6FEF6
0.90
HIGH (8.9)
D3F
🔍 MEDIUM
Missing logs (3)
  • Internal DNS server query logs with response authority and TTL fields
  • DNS response validation logs checking for anomalous TTL or authority flags
  • Network flow logs capturing DNS traffic between clients and server
SIEM rules (2)
Internal DNS server cache poisoning attempt detected
dns_query_logs and response_type=AXFR and (response_ttl > 86400 OR response_authority > 3) from non_internal_dns_servers
Unusual DNS response patterns from internal DNS server
dns_query_logs and (response_ttl > 604800 OR response_section_count > 10) grouped by source_ip
IOCs (3)
  • DNS responses with unusually high TTL values for internal records
  • AXFR zone transfer requests from internal workstations rather than secondary DNS servers
  • DNS responses containing internal IP ranges from external-facing DNS servers
# Target Business Value Source Description Conf. CVEs Severity Risk Signals CAPEC MITRE Techniques MITRE Mitigations D3FEND Mitigations CIS Mitigations NIST Mitigations OWASP Mitigations Detection (SOC)
1
 Edge Router N/A
pytm
Unpatched OS or software vulnerabilities on Edge Router leading to system compromise
TK-812D9E16
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
2
 Web Application Firewall N/A
pytm
Unpatched OS or software vulnerabilities on Web Application Firewall leading to system compromise
TK-68E9F01F
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
3
 Reverse Proxy N/A
pytm
Unpatched OS or software vulnerabilities on Reverse Proxy leading to system compromise
TK-5900CCAA
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
4
 Mail Gateway N/A
pytm
Unpatched OS or software vulnerabilities on Mail Gateway leading to system compromise
TK-AFD98C32
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
5
 Corporate VPN Gateway N/A
pytm
Unpatched OS or software vulnerabilities on Corporate VPN Gateway leading to system compromise
TK-4AF51EF3
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
6
 External Attacker N/A
pytm
Untrusted actor External Attacker may attempt to inject malicious data or exploit vulnerabilities in connected systems.
TK-315BA426
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
7
 Remote Employee N/A
pytm
Untrusted actor Remote Employee may attempt to inject malicious data or exploit vulnerabilities in connected systems.
TK-FAB4F40F
1.00
CRITICAL (10.0)
NET D3F
  • No specific OWASP mitigations found.
—
8
 Internal Firewall N/A
pytm
Unpatched OS or software vulnerabilities on Internal Firewall leading to system compromise
TK-3C0F2699
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
9
 Internal DNS Server N/A
pytm
Unpatched OS or software vulnerabilities on Internal DNS Server leading to system compromise
TK-A8E7D64D
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
10
 Employee Workstation N/A
pytm
Unpatched OS or software vulnerabilities on Employee Workstation leading to system compromise
TK-9A555214
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
11
 File Server N/A
pytm
Unpatched OS or software vulnerabilities on File Server leading to system compromise
TK-88D5184B
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
12
 Primary Domain Controller N/A
pytm
Unpatched OS or software vulnerabilities on Primary Domain Controller leading to system compromise
TK-9FBFCD57
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
13
 Backup Domain Controller N/A
pytm
Unpatched OS or software vulnerabilities on Backup Domain Controller leading to system compromise
TK-461FDA43
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
14
 PKI Certificate Authority N/A
pytm
Unpatched OS or software vulnerabilities on PKI Certificate Authority leading to system compromise
TK-C2F48E04
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
15
 SIEM Server N/A
pytm
Unpatched OS or software vulnerabilities on SIEM Server leading to system compromise
TK-31A6DDF0
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
16
 Jump Server N/A
pytm
Unpatched OS or software vulnerabilities on Jump Server leading to system compromise
TK-F515863E
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
17
 Financial ERP System N/A
pytm
Unpatched OS or software vulnerabilities on Financial ERP System leading to system compromise
TK-12889792
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
18
 Financial ERP System N/A
pytm
Data corruption or tampering in Financial ERP System via unauthorized write access
TK-29A24052
1.00
CRITICAL (10.0)
D3F
  • D3-BA: Bootloader Authentication
    Cryptographically authenticating the bootloader software before system boot.
  • D3-TBI: TPM Boot Integrity
    Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
  • D3-SU: Software Update
    Replacing old software on a computer system component.
  • D3-LFP: Local File Permissions
    Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality.
  • D3-SCF: System Call Filtering
    Controlling access to local computer system resources with kernel-level capabilities.
  • D3-SCP: System Configuration Permissions
    Restricting system configuration modifications to a specific user or group of users.
  • D3-EAL: Executable Allowlisting
    Using a digital signature to authenticate a file before opening.
  • D3-EDL: Executable Denylisting
    Blocking the execution of files on a host in accordance with defined application policy rules.
  • No specific OWASP mitigations found.
—
19
 Finance Workstation N/A
pytm
Unpatched OS or software vulnerabilities on Finance Workstation leading to system compromise
TK-06D0EA2C
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
20
 Source Code Repository N/A
pytm
Unpatched OS or software vulnerabilities on Source Code Repository leading to system compromise
TK-77A9D479
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
21
 CI CD Pipeline N/A
pytm
Unpatched OS or software vulnerabilities on CI CD Pipeline leading to system compromise
TK-696A3FF9
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
22
 Core Database Cluster N/A
pytm
Unpatched OS or software vulnerabilities on Core Database Cluster leading to system compromise
TK-A1C23435
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
23
 Core Database Cluster N/A
pytm
Data corruption or tampering in Core Database Cluster via unauthorized write access
TK-E97D387A
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
24
 Backup Server N/A
pytm
Unpatched OS or software vulnerabilities on Backup Server leading to system compromise
TK-34266401
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
25
 SCADA HMI N/A
pytm
Unpatched OS or software vulnerabilities on SCADA HMI leading to system compromise
TK-5F5D0823
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
26
 PLC Controller N/A
pytm
Unpatched OS or software vulnerabilities on PLC Controller leading to system compromise
TK-BE489857
1.00
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
—
27
 Jump Server N/A
AI
(AI) Jump Server Configuration Modification for Persistent Access: The Jump Server lacks redundant controls and has unknown encryption-at-rest status. An attacker with write access to the filesystem can modify SSH/RDP configuration, inject malicious binaries, or add unauthorized SSH keys, creating a persistent foothold that survives reboots and bypasses initial authentication.
TK-50107650
0.90
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
🔍 LOW
Missing logs (5)
  • Sysmon Event 1 — Process creation with command-line arguments on Jump Server
  • Sysmon Event 10 — Registry event creation on Jump Server
  • File integrity monitoring — Critical system files on Jump Server (e.g., sshd_config, sshd.exe)
  • Windows Security Event 4670 — Service configuration changes
  • Windows Security Event 4698 — Scheduled task creation on Jump Server
SIEM rules (2)
Jumper server RDP configuration modification
EventID=4670 AND ServiceName CONTAINS 'TermService' AND NewValue CONTAINS 'allow unauthenticated'
SSH daemon configuration modification
EventID=4670 AND ServiceName CONTAINS 'sshd' AND NewValue CONTAINS 'PermitRootLogin without-password'
IOCs (3)
  • Process creation: 'openssl' or 'nc' spawned from non-admin context on Jump Server
  • Registry path: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp — UserAuthentication enabled set to 0
  • Binary injection artifacts: DLL loads from unexpected paths into sshd or RDP processes
28
 Financial ERP System N/A
AI
(AI) Financial ERP General Ledger Modification via Credential Reuse: The Financial ERP System accepts credentials from the Jump Server and Finance Employees without MFA. An attacker who obtains valid user credentials (via phishing or insider threat) can authenticate to the ERP system and modify general ledger entries, invoice records, or payment parameters, resulting in financial fraud that is difficult to detect if audit trails are not rigorously enforced.
TK-3DEB6B09
0.90
CRITICAL (10.0)
D3F
  • No specific OWASP mitigations found.
🔍 MEDIUM
Missing logs (4)
  • SIEM — Successful authentication to Financial ERP System from non-Finance-Workstation sources
  • Active Directory — Successful logon events (4624) to ERP application from external or jump server IPs
  • EDR — Keylogger or credential dumping tool execution on Finance Workstation
  • Mail Gateway — Phishing emails targeting Finance Employees with ERP-themed subjects
SIEM rules (2)
ERP authentication from unexpected source IP
EventID=4624 AND ServiceName CONTAINS 'ERP' AND SourceIp NOT IN (FinanceWorkstationPool, VPN-Gateway) AND count > 1 within 1h
Failed ERP login attempts followed by success
EventID=4625 Service=ERP AND SourceIp = X.X.X.X AND followup EventID=4624 within 30m
IOCs (3)
  • Phishing emails with subject lines containing 'ERP', 'Payroll', 'Vendor Payment'
  • Keylogger artifacts: registry run keys referencing 'svchost.exe' or 'explorer.exe' in user temp paths
  • ERP login from IP ranges outside corporate finance subnet
29
 Source Code Repository N/A
AI
(AI) Source Code Repository Commit Tampering and Supply-Chain Injection: The CI/CD pipeline connects to the Source Code Repository over HTTPS with token-based authentication. An attacker with valid repository write access (obtained via credential theft or insider threat) can inject malicious code, backdoors, or supply-chain triggers into the main branch. If the CI/CD pipeline automatically builds and deploys changes, this tampered code can be propagated to production systems, compromising the manufacturing environment.
TK-565636C2
0.90
CRITICAL (10.0)
D3F
🔍 MEDIUM
Missing logs (4)
  • SCM — Git commit audit logs showing author, committer, and signature verification status
  • SIEM — Successful Git push events with write access from non-authorized IPs or users
  • EDR — Execution of git commands with push or commit operations from workstations
  • CI/CD — Pipeline logs showing trigger events and commit hashes for deployed builds
SIEM rules (2)
Git commit push from unexpected source IP or user
EventID=git_push AND Author != ExpectedMaintainer AND SourceIp NOT IN (CI_CD_Subnet, DeveloperSubnet) AND AccessLevel = write
Git commit without signature verification
GitEvent AND SignatureVerified = false AND Author IN (Maintainers) AND Repository = CoreRepo
IOCs (3)
  • Commit messages: 'urgent fix', 'hotpatch', 'quick update' with minimal changes to core files
  • Author name/email changes: deviations from expected maintainer patterns
  • Push events to repository branches not normally targeted by CI/CD pipeline