# Threat Modeling Guide

## Scenario Format
Each threat scenario should include:
1. **Vector** — attack path and technique
2. **Prerequisites** — required access, data, or conditions
3. **Impact** — potential consequences if successful
4. **Likelihood** — probability assessment based on gathered data
5. **Evidence** — supporting data points from findings

## Exposure Categories

### EC1 — Credential Exposure (T1078)
Username/password pairs from browser storage, credential managers.
Validation status, password reuse graph, rotation history.

### EC2 — Session Token Exposure (T1539)
Browser cookies, OAuth tokens, API keys, JWT sessions.
Validity window, privilege scope, hijack feasibility.

### EC3 — Financial Asset Exposure
Banking credentials, payment card autofill, cryptocurrency wallet files/seeds.
Direct monetary impact assessment.

### EC4 — Identity Cascade Risk
Email account access enabling password reset chains.
Social media account takeover enabling impersonation.
Corporate SSO exposure enabling lateral access.

### EC5 — Infrastructure Exposure (T1528)
Cloud credentials (AWS keys, GCP service accounts), VPN certificates.
CI/CD tokens, container registry access, SSH keys.