yashomer1994.github.io

August 30, 2026 · Offensive Cyber Operations with AI

Threat ModelingMITRE ATT&CKRAGGroqSTRIDELangChain

AI Red Teaming Lab 2: AI-Driven Threat Modeling, Attack Planning & STRIDE-GPT — a technical write-up

Lab 2 has two exercises. Exercise 1 is a Flask + Groq app ("SecOps Intelligence Hub") that ingests CTI/DFIR PDF reports, extracts MITRE ATT&CK techniques, and answers questions in two personas — a defensive CTI Report mode and an offensive Red Team mode. Exercise 2 uses STRIDE-GPT to generate a STRIDE threat model from an architecture diagram. The core lesson: the same report produces completely different output depending on the system prompt — persona engineering is the tool.

Key result: one CTI report, two personas — the defensive chain yields MITRE-mapped countermeasures, the offensive chain yields a full adversary-emulation plan from the same context.

Attack path (how the steps chain)

  1. Ingest real adversary tradecraft — upload the APT-Shadow Dragon CTI report; the pipeline extracts text and indexes it for retrieval.
  2. Map to MITRE ATT&CK — regex + LLM extraction surfaces the techniques the actor actually used (T1566.001 phishing → T1053.005/T1547.001 persistence → T1003.001 LSASS dump → T1021.001 RDP → T1041 exfil).
  3. Flip the persona — the same context, re-prompted as a red teamer, explains why each technique works and which defensive gap it exploits.
  4. Generate the emulation plan — the scenario chain assembles a full kill chain: OSINT → macro spear-phish → persistence → credential theft → lateral movement → objective (fraudulent transfers).
  5. Model the target — STRIDE-GPT turns an architecture diagram into a threat model and attack tree, the planning step that precedes any engagement.

1. Exercise 1 — SecOps Intelligence Hub

1.1 Setup

cd "Labs-2/File Analysis"
python -m venv venv && source ./venv/bin/activate
pip install -r requirements.txt   # flask, langchain-groq, faiss-cpu, PyMuPDF, easyocr...
# edit .env: GROQ_API_KEY=gsk_your_key
python app.py                     # http://127.0.0.1:5000

Look for [OK] GROQ_API_KEY loaded at startup. The first PDF upload downloads the all-MiniLM-L6-v2 embedding model (~90 MB) — expect 30–120 s.

1.2 How the pipeline works (code walkthrough)

1.3 Solution steps

  1. Upload uploads/CTI Report - APT-Shadow Dragon.pdf in Report Ingestion.
  2. CTI mode, Prompt 1: "Extract all MITRE ATT&CK technique IDs mentioned or implied in this report."
  3. Red Team mode, Prompt 1: "Explain why each technique is effective and what security gap it exploits."
  4. Scenario generation: click Generate (Red mode) or ask for a full attack scenario with initial access → persistence → lateral movement → objectives.
  5. Optional: /engagement with an industry parameter (e.g. "banking") for a tailored plan.

1.4 Expected results (APT-Shadow Dragon report)

Regex extraction should surface the kill-chain techniques:

Red Team mode should explain the gaps: T1566.001 exploits the human layer, T1003.001 exploits missing Credential Guard/EDR, T1021.001 exploits flat networks, T1041 exploits absent egress monitoring. The generated scenario chains OSINT → macro-laden spear-phish → DracoNet install → scheduled-task/run-key persistence → LSASS dump → RDP/WMI lateral movement → SWIFT terminal discovery → HTTPS exfil → fraudulent transfers.

2. Exercise 2 — STRIDE-GPT

git clone https://github.com/mrwadams/stride-gpt.git
cd stride-gpt && python -m venv venv && source ./venv/bin/activate
pip install -r requirements.txt
streamlit run main.py             # http://localhost:8501

Fill in the app metadata for the provided Desktop application threat model diagram.png (desktop app, no auth, not internet-facing, processes sensitive user files), upload the diagram, and generate the threat model + attack tree. The diagram is a simple trust model: User ↔ Desktop App ↔ File System.

Expected STRIDE output for this diagram:

Typical mitigations generated: code signing, least-privilege execution, sandboxed parsing, secure file permissions, audit logging, signed auto-updates.

3. Troubleshooting

References

← Home · ← Lab 1 · Lab 3 →