Skip to content
flowss
Start freeChecking your session
Attack tree (cybersec) templates

Attack tree — cloud account takeover

AWS / SaaS account takeover paths.

Attack tree (cybersec)Operations & OpsAttack tree (cybersec) syntax docs
Template previewAttack tree (cybersec)
Cloud account takeoverGOALcost 8Take over root cloudaccountORcost 8Compromise rootcredentialsANDcost 8Bypass MFALEAFcost 1Phish adminlowdet mediumLEAFcost 3Steal session tokenmediumdet mediumLEAFcost 4SIM-swap admin numbermediumdet lowORcost 8Hijack federationLEAFcost 8Compromise SSO IdPhighdet high

Make it your own.

title "Cloud account takeover"
goal G "Take over root cloud account"
OR   G1 "Compromise root credentials" parent G
OR   G2 "Hijack federation"          parent G
AND  G3 "Bypass MFA"                 parent G1
leaf L1 "Phish admin"                parent G3 cost 1 skill low    detect medium
leaf L2 "Steal session token"        parent G3 cost 3 skill medium detect medium
leaf L3 "SIM-swap admin number"      parent G3 cost 4 skill medium detect low
leaf L4 "Compromise SSO IdP"         parent G2 cost 8 skill high   detect high