title: My attack condition: Email list event: Send phishing email needs: Email list AND Payload ready result: Email opened helped by: No mail filtering ttp: T1566.001, T1204.002 mitigation: M1017, M1049 severity: 4 mitigability: 3 phase: D
condition:a state that exists before an event.event:something the attacker does or that happens.- Lines under an event are indented by two spaces.
needs:names conditions or earlier results. Join them withAND(all needed) orOR(any one is enough), not both.result:the state the event leads to. Later events can need it.- Add
(uncertain)after a description to draw it dotted, and(goal)after the final result. - Add
(draft)after an event you haven't placed yet — it's drawn greyed as a reminder and won't nag for a needs: line until you're ready. + Event starts new events as drafts. - Move an event down to a chosen row with
band:, e.g.band: 3, or use Move up/Move down in the panel. An event can't sit above the band itsneeds:put it in. - Nudge a box sideways with
nudge: -20(negative is left, positive right), or centre it on the page withnudge: centre; the panel has Nudge left, Nudge right and Centre box buttons. Its enablers move with it. - Put
?after a single code to mark just that code uncertain, e.g.T1056.001? severity:1 low to 5 high.mitigability:1 hard to 5 easy to mitigate.- Other scores an event can carry, each 1 to 5:
likelihood:,skill:,effort:,detectability:,confidence:,ease of implementation:. cve:lists real vulnerabilities exploited, e.g.cve: CVE-2021-44228. Hover a CVE to see its NVD description and CVSS score; turn on the CVSS corner in Display to show the score on the box.- Add your reasoning to a score after a dash, e.g.
severity: 4 - admin access; hover the circle to read it. Add a note to a code after~, e.g.ttp: T1566.001 ~ fake invoice. On the graph, use Pick TTP… / Pick mitigation… in the panel to choose codes from a searchable list instead of the MITRE website. - Lines starting with
#are notes and aren't drawn.
Display. Choose what each event's corners show with Display… above the graph, or with statements:
top left: phase top right: risk bottom left: severity, mitigability bottom right: off colours: colour-blind safe
- Each of the top left, top right and bottom left corners holds up to two items:
phase,risk(likelihood × severity, 1 to 25) or any score. Writeoffto leave a corner empty. bottom right: offhides the event tags and the TTP and mitigation columns.- Change a score's range and meaning with, for example,
severity scale: 1 to 10 (1 minor, 10 critical), and the risk colours withrisk bands: 4, 12(low up to 4, medium up to 12, high above). text size: small,standardorlarge.box size: fixedmakes every box the same size and warns when a description is too long to fit.- Colours:
standard,colour-blind safe,greyscaleorblack and white.
- Attack tree (top of the page) redraws your graph as a Schneier-style attack tree: the goal at the top, the steps that reach it branching below, with AND (a joining bar) and OR. Turn the boxes off for the classic plain-text tree, or download it as an SVG.
- MITRE chart maps the TTPs you've used onto the ATT&CK tactics, and can download a Navigator layer or attach one to your email.
- Code, Notes and Syntax each switch a pane on or off. In Notes you can plan before you build: select text and right-click to add a comment or a reference (they show as markers like [c1] and appear in lists underneath), or to turn a sentence into a condition or a draft event in your graph. Float pops the notes out into a panel you can move and resize, and Expand makes them bigger. Your notes are saved with your graph and your tutor can see them; typing and pasting in them is recorded in the activity log like the code.
- Export… lets you tick what to export (graph file, activity log report, notes, SVG, PNG, MITRE layer, attack tree) and download it as separate files or as one zip ready to submit. The graph file in it always includes the activity log.
ATT&CK codes. Hover over a T or M code in the statements or on the graph to see what it is. Codes are checked against MITRE ATT&CK: an unknown code is an error, and a withdrawn or deprecated one is a warning.
Your own techniques and mitigations. If ATT&CK doesn't have what you need, define your own, either by pressing Create… next to the error or by writing:
custom technique: T1566.901 name: Phishing via QR code tactic: Initial Access description: A QR code leads to a fake login page.
Use numbers in the 9000s (T9001, M9001), or .901 upwards under an existing technique, so they never clash with ATT&CK's own. They're marked * on the graph.
MITRE ATT&CK® names and descriptions © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Activity log. The builder records how you build your graph: what you type, paste and delete, changes you make on the graph, and when you leave the builder and for how long. The log is kept with your graph, goes into the file when you save, and is sent to your tutor when you email your work. More about this