PASTA Stage 4: Threat Analysis

Identify threats using real-world intelligence, attack patterns, and adversary tactics. Cross-reference with MITRE ATT&CK to ground analysis in actual attacker behavior. Map threats to the components and trust boundaries from Stage 3.

Supported Flags

Read ../../shared/schemas/flags.md for the full flag specification. Key behaviors:

Flag	Stage 4 Behavior
--scope	Inherits from prior stages. Focuses on components and entry points from Stages 2-3.
--depth quick	Top 5 most likely threats based on technology stack only.
--depth standard	Full threat catalog with MITRE ATT&CK mappings for all components.
--depth deep	Standard + attack tree construction, supply chain analysis, insider threat modeling.
--depth expert	Deep + adversary persona simulation with detailed TTPs per actor profile.
--severity	Filter threats by estimated impact level.

Framework Context

Read ../../shared/frameworks/pasta.md, Stage 4 section. PASTA is SEQUENTIAL. Stage 4 consumes Stages 1-3 output and feeds Stage 5.

Prerequisites

Required: Stage 3 output -- component inventory, role-permission matrix, data classification, trust boundaries. Also needs: business-critical assets (Stage 1), entry points and attack surface (Stage 2). If unavailable, warn and assume.

Workflow

Step 1: Profile Threat Actors

1. Opportunistic external: Automated scanners, credential stuffing. Targets known CVEs.
2. Targeted external: Researched attack on business logic, custom vulns.
3. Malicious insider: Legitimate access, targets escalation and exfiltration.
4. Supply chain: Compromised dependency or build pipeline.
5. APT/nation-state: Significant resources, targets IP and infrastructure.

Step 2: Map MITRE ATT&CK Techniques

Technique	Name	Relevance
T1190	Exploit Public-Facing App	Internet-facing endpoints
T1059	Command/Scripting Interpreter	Server-side execution paths
T1078	Valid Accounts	Authentication mechanisms
T1098	Account Manipulation	User/role management
T1134	Access Token Manipulation	JWT/session handling
T1552	Unsecured Credentials	Secrets in config files
T1210	Exploit Remote Services	Service-to-service calls
T1195	Supply Chain Compromise	Third-party dependencies

Step 3: Identify Attack Patterns

For each component: review stack-specific attack history, map patterns to entry points, assess feasibility given controls, and identify cross-component chains.

Step 4: Analyze Supply Chain

Check dependency manifests for count, known CVEs (via SCA tooling), undermaintained packages, typosquatting risk, and CI/CD pipeline security.

Step 5: Build Threat-to-Component Matrix

Map each threat to target component(s), exploited entry point(s), and endangered business asset(s).

Analysis Checklist

1. What MITRE ATT&CK techniques are most relevant to this stack?
2. What attacks are commonly seen against similar applications?
3. What would a motivated insider with legitimate access attempt?
4. Which dependencies have known CVEs or are poorly maintained?
5. What chains could pivot from low-privilege entry to high-value assets?
6. Are there public exploits for the framework versions in use?
7. Which threat actors are most likely to target this application type?
8. Are there seasonal or event-driven threat patterns relevant here?

Output Format

Stage 4 produces a Threat Catalog. ID prefix: PASTA (e.g., PASTA-S4-001).

## PASTA Stage 4: Threat Analysis

### Threat Actor Profiles
| Actor | Motivation | Capability | Likely Targets | Likelihood |
|-------|-----------|-----------|---------------|------------|
| Opportunistic | Financial gain | Low-Med | Known CVEs, weak auth | High |
| Targeted | Data theft | Med-High | Business logic, APIs | Medium |
| Insider | Revenge/profit | High | Data exfil, backdoors | Low-Med |
| Supply chain | Broad compromise | Medium | Dependencies, CI/CD | Low |

### Threat Catalog
| ID | Threat | MITRE ATT&CK | Component | Asset | Likelihood |
|----|--------|-------------|-----------|-------|------------|
| T-01 | SQL injection via search | T1190 | C-02 API | User DB | High |
| T-02 | Credential stuffing | T1078 | C-01 Auth | Accounts | High |

### Attack Trees (--depth deep+)
Goal: Access customer payment data
  OR
  +-- Exploit SQL injection -> extract tokens -> impersonate admin
  +-- Credential stuff admin login -> access /admin/export
  +-- Compromise npm dependency -> backdoor payment module

### Supply Chain Assessment
| Dependency | Risk | CVEs Known | Maintainer Status |
|-----------|------|-----------|------------------|

Findings follow ../../shared/schemas/findings.md with:

• references.mitre_attck: Technique ID (e.g., "T1190")
• metadata.tool: "pasta-threats", metadata.framework: "pasta", metadata.category: "Stage-4"

Next Stage

Stage 5: Vulnerability Analysis (pasta-vulns). Pass the Threat Catalog and MITRE ATT&CK mappings. Stage 5 analyzes code for specific vulnerabilities that enable the threats identified here.