Attack Tree Construction
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
Nothing to install and no account needed. Copy & open drops the whole skill straight into the chat box.
| 1 | |
| 2 | name attack-tree-construction |
| 3 | description Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders. |
| 4 | |
| 5 | |
| 6 | # Attack Tree Construction |
| 7 | |
| 8 | Systematic attack path visualization and analysis. |
| 9 | |
| 10 | ## When to Use This Skill |
| 11 | |
| 12 | Visualizing complex attack scenarios |
| 13 | Identifying defense gaps and priorities |
| 14 | Communicating risks to stakeholders |
| 15 | Planning defensive investments |
| 16 | Penetration test planning |
| 17 | Security architecture review |
| 18 | |
| 19 | ## Core Concepts |
| 20 | |
| 21 | ### 1. Attack Tree Structure |
| 22 | |
| 23 | |
| 24 | [Root Goal] |
| 25 | | |
| 26 | ┌────────────┴────────────┐ |
| 27 | │ │ |
| 28 | [Sub-goal 1] [Sub-goal 2] |
| 29 | (OR node) (AND node) |
| 30 | │ │ |
| 31 | ┌─────┴─────┐ ┌─────┴─────┐ |
| 32 | │ │ │ │ |
| 33 | [Attack] [Attack] [Attack] [Attack] |
| 34 | (leaf) (leaf) (leaf) (leaf) |
| 35 | |
| 36 | |
| 37 | ### 2. Node Types |
| 38 | |
| 39 | | Type | Symbol | Description | |
| 40 | | -------- | --------- | ----------------------- | |
| 41 | | **OR** | Oval | Any child achieves goal | |
| 42 | | **AND** | Rectangle | All children required | |
| 43 | | **Leaf** | Box | Atomic attack step | |
| 44 | |
| 45 | ### 3. Attack Attributes |
| 46 | |
| 47 | | Attribute | Description | Values | |
| 48 | | ------------- | ----------------------- | ------------------ | |
| 49 | | **Cost** | Resources needed | $, $$, $$$ | |
| 50 | | **Time** | Duration to execute | Hours, Days, Weeks | |
| 51 | | **Skill** | Expertise required | Low, Medium, High | |
| 52 | | **Detection** | Likelihood of detection | Low, Medium, High | |
| 53 | |
| 54 | ## Templates and detailed worked examples |
| 55 | |
| 56 | Full template library lives in `references/details.md`. Read that file when you need concrete templates for this skill. |
| 57 | |
| 58 | ## Best Practices |
| 59 | |
| 60 | ### Do's |
| 61 | |
| 62 | **Start with clear goals** - Define what attacker wants |
| 63 | **Be exhaustive** - Consider all attack vectors |
| 64 | **Attribute attacks** - Cost, skill, and detection |
| 65 | **Update regularly** - New threats emerge |
| 66 | **Validate with experts** - Red team review |
| 67 | |
| 68 | ### Don'ts |
| 69 | |
| 70 | **Don't oversimplify** - Real attacks are complex |
| 71 | **Don't ignore dependencies** - AND nodes matter |
| 72 | **Don't forget insider threats** - Not all attackers are external |
| 73 | **Don't skip mitigations** - Trees are for defense planning |
| 74 | **Don't make it static** - Threat landscape evolves |
| 75 |
Alternatives
Also in SecurityAnti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.Memory ForensicsMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.