<mxfile host="app.diagrams.net" agent="ThreatTree" version="24.0.0" type="device">
  <diagram name="Attack Tree Template" id="attack-tree-template">
    <mxGraphModel dx="1200" dy="800" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1000" pageHeight="750" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />

        <!-- Legend -->
        <mxCell id="legend-box" value="Legend" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=#94A3B8;verticalAlign=top;align=left;fontStyle=1;fontSize=12;spacingLeft=6;spacingTop=4;" vertex="1" parent="1">
          <mxGeometry x="20" y="20" width="220" height="230" as="geometry" />
        </mxCell>
        <mxCell id="legend-goal" value="Goal" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#F8D7DA;strokeColor=#DC2626;fontSize=11;fontStyle=1;" vertex="1" parent="1">
          <mxGeometry x="30" y="50" width="120" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-gate" value="AND / OR gate" style="rhombus;whiteSpace=wrap;html=1;fillColor=#FFF2CC;strokeColor=#D6B656;fontSize=10;" vertex="1" parent="1">
          <mxGeometry x="55" y="90" width="70" height="40" as="geometry" />
        </mxCell>
        <mxCell id="legend-branch" value="Sub-goal / branch" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#DAE8FC;strokeColor=#6C8EBF;fontSize=11;" vertex="1" parent="1">
          <mxGeometry x="30" y="140" width="120" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-leaf" value="Leaf: atomic attack step" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#D5E8D4;strokeColor=#82B366;fontSize=11;" vertex="1" parent="1">
          <mxGeometry x="30" y="180" width="180" height="30" as="geometry" />
        </mxCell>

        <!-- Goal -->
        <mxCell id="goal" value="Goal: Exfiltrate Customer PII from Database" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#F8D7DA;strokeColor=#DC2626;fontStyle=1;" vertex="1" parent="1">
          <mxGeometry x="380" y="30" width="280" height="60" as="geometry" />
        </mxCell>

        <!-- OR gate -->
        <mxCell id="or1" value="OR" style="rhombus;whiteSpace=wrap;html=1;fillColor=#FFF2CC;strokeColor=#D6B656;" vertex="1" parent="1">
          <mxGeometry x="480" y="130" width="80" height="50" as="geometry" />
        </mxCell>
        <mxCell id="e-goal-or1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;" edge="1" parent="1" source="goal" target="or1">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>

        <!-- Two branches -->
        <mxCell id="branch1" value="Compromise Application Layer" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#DAE8FC;strokeColor=#6C8EBF;" vertex="1" parent="1">
          <mxGeometry x="220" y="230" width="220" height="50" as="geometry" />
        </mxCell>
        <mxCell id="branch2" value="Compromise DB Credentials Directly" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#DAE8FC;strokeColor=#6C8EBF;" vertex="1" parent="1">
          <mxGeometry x="620" y="230" width="220" height="50" as="geometry" />
        </mxCell>
        <mxCell id="e-or1-b1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;" edge="1" parent="1" source="or1" target="branch1">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="e-or1-b2" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;" edge="1" parent="1" source="or1" target="branch2">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>

        <!-- AND gate under branch1 -->
        <mxCell id="and1" value="AND" style="rhombus;whiteSpace=wrap;html=1;fillColor=#FFF2CC;strokeColor=#D6B656;" vertex="1" parent="1">
          <mxGeometry x="290" y="330" width="80" height="50" as="geometry" />
        </mxCell>
        <mxCell id="e-b1-and1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;" edge="1" parent="1" source="branch1" target="and1">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>

        <!-- Leaves under AND gate -->
        <mxCell id="leaf1" value="Discover SQL injection point&#10;(CAPEC-66, unauthenticated scan)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#D5E8D4;strokeColor=#82B366;" vertex="1" parent="1">
          <mxGeometry x="140" y="430" width="200" height="60" as="geometry" />
        </mxCell>
        <mxCell id="leaf2" value="Exploit SQLi to dump table&#10;(CAPEC-7)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#D5E8D4;strokeColor=#82B366;" vertex="1" parent="1">
          <mxGeometry x="360" y="430" width="200" height="60" as="geometry" />
        </mxCell>
        <mxCell id="e-and1-l1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;" edge="1" parent="1" source="and1" target="leaf1">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="e-and1-l2" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;" edge="1" parent="1" source="and1" target="leaf2">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>

        <!-- Leaf under branch2 -->
        <mxCell id="leaf3" value="Phish database administrator&#10;for credentials (CAPEC-98)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#D5E8D4;strokeColor=#82B366;" vertex="1" parent="1">
          <mxGeometry x="630" y="330" width="200" height="60" as="geometry" />
        </mxCell>
        <mxCell id="e-b2-l3" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;" edge="1" parent="1" source="branch2" target="leaf3">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>

        <!-- Instructions note -->
        <mxCell id="note" value="Every leaf should be an atomic, testable step. Score feasibility/likelihood and impact per leaf, then roll the highest-risk path up to prioritize mitigations." style="text;html=1;fontSize=11;fontColor=#64748B;align=left;verticalAlign=top;whiteSpace=wrap;" vertex="1" parent="1">
          <mxGeometry x="20" y="540" width="440" height="60" as="geometry" />
        </mxCell>

      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
