Cirius Group Threat Model

Purpose: Living threat model for Cirius Group. Defines crown jewel assets, realistic threat actors, STRIDE-based attack paths against those assets, and the controls mapped against each attack chain. This document is the single canonical security-reasoning reference — every security project, detection agent, tabletop, and compliance artifact should be traceable back to an item in this document.

Status: READY FOR REVIEW by Greg and Kevin (see §9).

Owner: Rory (Security Officer) Audience: Security Officer, T1 Domain Admins (Greg, Kevin), engineering, auditors (SOC2 September 2026) Scope: Azure PROD (ciriusgroup.com, tenant d477c9f8), Azure DDE (ciriusdde.com, tenant ff1c5d68), AWS 7-account organization, SaaS fabric (M365, Cortex, Arctic Wolf, Twingate, Keeper). Review frequency: Annual in December (see §10) plus any of: major incident, material environment change, new crown jewel added, new actor emerges. Last reviewed: April 2026 (initial production version).

---

Contents

1. Executive summary
2. Crown jewel inventory (TMOD-001)
3. Threat actor profiles (TMOD-002)
4. STRIDE analysis on crown jewel attack paths (TMOD-003)
5. Controls mapped to each attack chain (TMOD-004)
6. Aggregate coverage and residual risk
7. Recommendations
8. Cross-references
9. Ready-for-review note (TMOD-006)
10. Review schedule (TMOD-005, TMOD-007)

---

1. Executive summary

Cirius Group is a small healthcare services business operating in a high-threat environment. We handle ePHI on behalf of healthcare customers and host a customer-facing published application for Medicare patients inside the DDE tenant (ciriusdde.com). The November 2024 ransomware incident is the anchoring event of this threat model — the patterns observed there drive actor selection, crown jewel prioritization, and detection investment.

Key findings:

1. The single highest-likelihood, highest-impact actor is the ransomware-as-a-service (RaaS) affiliate operating on a credential-spray → lateral-movement → backup-destruction → encryption pattern. LockBit, ALPHV/BlackCat, and Akira have each targeted healthcare SMBs of our size in the past 24 months and are assumed to be persistently on the target list.
2. The top crown jewels are the DDE AVD environment (PHI access plane), the on-prem/Azure AD forests (identity authority), Terraform state (infrastructure authority), and Veeam/backup targets (recovery authority). The Palo Alto Panorama, cirius-openai-kv-prod, psql-secops-prod, and the 18 break-glass accounts round out the crown jewel set.
3. Preventive control coverage is strong across every kill chain stage — Conditional Access, Twingate ZTA, Palo Alto + DNS Security, Cortex XDR, Arctic Wolf MDR, Intune, immutable backup. There is no kill chain stage with zero preventive coverage.
4. Detective control coverage has live gaps at stages 2–7 — execution, persistence, credential dumping, lateral movement, exfiltration, defense evasion. Every one of these gaps is under active remediation as kill-chain Phase 1 (audit policy enablement) and Phase 2 (agent build).
5. A phishing / credential-spray campaign is currently active against Cirius user identities (justinc, gregd, adrianam, paulb, sophien, lauramaeb). This is an opportunistic actor and is covered under Actor Profile 3 below.

By the September 2026 SOC2 audit window, with kill-chain Phase 1 and Phase 2 complete, residual risk should drop from its current MEDIUM-HIGH posture to LOW-MEDIUM across all crown jewels.

---

2. Crown jewel inventory (TMOD-001)

A crown jewel asset is any system, dataset, or credential whose compromise would cause disproportionate harm — to patients, customers, the business, or the organization's ability to recover. Crown jewels are selected against five criteria:

1. PHI concentration — stores, processes, or routes significant ePHI
2. Identity authority — compromise grants privilege to impersonate any user or workload
3. Infrastructure authority — compromise grants the ability to reshape the environment itself
4. Network authority — compromise grants visibility into, or control over, traffic
5. Recovery authority — compromise undermines our ability to recover from a prior compromise
6. Key material — holds encryption keys or secrets whose exfiltration unlocks other resources

The inventory is ranked by impact-if-compromised, worst first.

CJ-1 — DDE AVD environment (PHI / Medicare)

• Category: 1 (PHI concentration), 2 (identity — DDE tenant)
• Location: Azure DDE tenant ciriusdde.com (ff1c5d68) — AVD host pool + published app serving Medicare patients
• What it is: The customer-facing AVD and published app that Medicare patients connect to. The PHI access plane. This is the reason Cirius Group has a HIPAA obligation at all.
• Impact if compromised: CRITICAL. Direct PHI exposure at scale. HHS Breach Notification Rule triggered. Loss of Medicare customer relationship. Potential regulatory penalties. This is the single most sensitive asset in the environment.
• Existing controls: Separate DDE tenant (blast-radius isolation from PROD), Conditional Access with device compliance, Cortex XDR on AVD session hosts, Arctic Wolf visibility, DDE has its own break-glass, DDE SecOps agents report with source_system=DDE.
• Residual risk: HIGH until kill-chain agents are live across DDE and FIDO2 covers all privileged DDE accounts.

CJ-2 — Active Directory forests (ACTDIRAZP01 / ACTDIRAZP02 and DDE equivalents)

• Category: 2 (identity authority), 6 (stores KRBTGT and machine account passwords)
• Location: Azure PROD and Azure DDE — ACTDIRAZP01 / ACTDIRAZP02 in PROD, DDE forest equivalents
• What it is: The authoritative identity fabric for every Windows workload — domain controllers, all user and machine authentication, KRBTGT, GPO deployment.
• Impact if compromised: CRITICAL. A single DC compromise yields domain-wide privilege. DCSync extracts every user's password hash and the KRBTGT key. With KRBTGT, an attacker forges Golden Tickets valid until KRBTGT is rotated twice. GPO modification lets the attacker push ransomware to every domain-joined host.
• Existing controls: Tier 0 isolation, restricted DA membership, Cortex XDR on DCs, Arctic Wolf visibility, 4662 SACL for DCSync (scheduled), 5136/5137 directory-service events, KRBTGT rotation cadence, break-glass rotation procedure.
• Residual risk: HIGH. DCSync detection and Pass-the-Hash detection agents are in build.

CJ-3 — Terraform state (S3 + Azure Storage)

• Category: 3 (infrastructure authority), 6 (contains secret outputs)
• Location: Azure Storage (azure-infra, azure-dde-infra, ops-automation, bedrock-hub) + S3 in each AWS account (aws-infra)
• What it is: The source-of-truth description of every cloud resource — identities, roles, network topology, secret references, resource relationships. State files contain resource IDs and, where providers leak them, sensitive attributes.
• Impact if compromised: CRITICAL. A write-capable attacker can surreptitiously modify state to unmanage resources, hide them from drift detection, or prepare a coordinated infrastructure change that bypasses PR review. A read-capable attacker maps the entire environment from a single file.
• Existing controls: State storage private; storage-account firewall restricts access to OIDC federated identities (github-deploy-main per subscription/account); AWS S3 versioning; Azure Storage soft-delete; access logs to LAW / CloudTrail; no local terraform apply permitted; every state change goes through PR + CI.
• Residual risk: MEDIUM. Key residual vector is OIDC identity compromise via a poisoned GitHub Action. Mitigated by SHA-pinning every Action.

CJ-4 — Veeam backup targets (AWS S3 with Object Lock) and RSV copies

• Category: 5 (recovery authority)
• Location: Veeam infrastructure → AWS S3 Object Lock (primary offsite, 2190d) + Azure Recovery Services Vaults (secondary, immutability Unlocked)
• What it is: The last line of defense against ransomware. If everything else burns, this is what we restore from.
• Impact if compromised: CRITICAL in combination with a ransomware event. Without immutable backups, we pay or fail. With them, we recover.
• Existing controls: S3 Object Lock (write-once 2190d, independent of Veeam state), RSV immutability, Veeam service account isolated from AD admin tier, dedicated management network, monthly restore spot-check, Q2 + Q4 DR tests scheduled.
• Residual risk: MEDIUM — validation by Q2 DR test (compliance/q2-dr-test-plan-2026.md).

CJ-5 — Palo Alto Panorama

• Category: 4 (network authority)
• Location: Panorama management VM + 4 VM-Series enforcement nodes
• What it is: Central policy, central logging, central visibility for east-west and north-south traffic. DNS Security blocks C2 callbacks. Central authority for perimeter defense.
• Impact if compromised: HIGH. Attacker can alter security policy (allow egress, disable DNS Security), disable decryption, remove logging destinations, blind network-based detection. Does not directly touch PHI but removes the ability to see an attacker doing so.
• Existing controls: Management network isolated, named admin accounts with MFA, config backup on schedule, credential rotation procedure (security/palo-alto-backup-credential-rotation.md), syslog shipped to LAW independent of Panorama, local break-glass per firewall.
• Residual risk: MEDIUM. Syslog redundancy means Panorama compromise is survivable, but tampering window is real.

CJ-6 — psql-secops-prod (SecOps platform PostgreSQL)

• Category: 1 (PHI metadata concentration), 3 (integrity of the incident/audit trail)
• Location: Azure PROD, rg-logging-logs (logging subscription). PostgreSQL 15 Flexible Server.
• What it is: The database behind the SecOps platform — every incident, every finding, every known-good rule, every change ticket, every piece of evidence. References to PHI context. Audit authority.
• Impact if compromised: HIGH. Tampered incident records destroy non-repudiability. A read-capable attacker sees every detection and every suppression rule, enabling targeted evasion. Direct PHI volume is low but context is significant.
• Existing controls: Private endpoint only, Entra AD authentication only (no local SQL accounts), PITR 35d, CMK encryption, Palo Alto egress inspection, Defender for SQL, Keeper PAM session recording on admin access, break-glass suppression hard-blocked at API level. pgaudit enablement in progress.
• Residual risk: MEDIUM until pgaudit is live and streamed to LAW.

CJ-7 — cirius-openai-kv-prod (and the CMK vaults)

• Category: 6 (key material)
• Location: Azure PROD. Multiple Key Vaults — cirius-openai-kv-prod for app secrets, additional CMK vaults backing storage and KV-managed HSM.
• What it is: Azure OpenAI secrets, SecOps API keys, third-party API credentials, CMKs that encrypt data at rest across storage accounts and databases.
• Impact if compromised: HIGH. CMK compromise enables decryption of data at rest for every resource using that key. App-secret compromise grants whatever the secret permits (SecOps API, ingest, AI endpoints).
• Existing controls: Soft delete + purge protection, Entra identity–only access, diagnostic logs to LAW, quarterly rotation for app secrets, vault firewall, private endpoint where supported.
• Residual risk: MEDIUM. Key material is only as safe as the identity that can access it; RBAC and Conditional Access on workload identities is the mitigating layer.

CJ-8 — Break-glass accounts (18 total)

• Category: 2 (identity — emergency)
• Location: On-prem AD (3), AWS root (7), Entra PROD (2), Entra DDE (2), Palo Alto local admin (4).
• What it is: The highest-privilege credentials in their respective trust boundaries. By design, they bypass MFA, PIM, and (in some cases) Conditional Access so that a real emergency is survivable.
• Impact if compromised: HIGH. Instant top-privilege for that boundary. Only reason this is not CRITICAL is that detection is guaranteed — any use is a permanently unsuppressible CRITICAL alert.
• Existing controls: Permanently unsuppressible audit rule, API-level hard block against being added to any known-good rule, Keeper storage with split knowledge where feasible, physical safekeeping for offline credentials, twice-yearly viability drill.
• Residual risk: LOW. Detection certainty is the compensating control; real risk is physical custody.

Impact ranking (worst first)

Rank	ID	Asset	Impact if compromised	Primary category
1	CJ-1	DDE AVD environment (PHI)	CRITICAL	PHI concentration
2	CJ-2	AD forests	CRITICAL	Identity authority
3	CJ-3	Terraform state	CRITICAL	Infrastructure authority
4	CJ-4	Veeam backup targets	CRITICAL (in combination)	Recovery authority
5	CJ-5	Palo Alto Panorama	HIGH	Network authority
6	CJ-6	psql-secops-prod	HIGH	PHI metadata + integrity
7	CJ-7	cirius-openai-kv-prod	HIGH	Key material
8	CJ-8	Break-glass accounts	HIGH	Identity (emergency)

---

3. Threat actor profiles (TMOD-002)

We model realistic actors for a healthcare SMB of Cirius Group's size. We do not model capabilities that do not match our threat surface (e.g., we do not model destructive wiper APTs targeting industrial control systems — we don't run ICS). We do model actors who have hit businesses of our shape in the last 24 months.

Actor 1 — Ransomware groups targeting healthcare (RaaS affiliates)

• Named groups of concern: LockBit (and successor branding), ALPHV / BlackCat (and successors), Akira.
• Motivation: Financial. Affiliate receives a share of ransom; operator takes the rest. Healthcare is a preferred sector because of operational urgency and data sensitivity — victims pay faster.
• Likelihood: HIGH. The November 2024 incident demonstrates we are on the target list. RaaS affiliates recycle targets for 12–24 months.
• Impact: CRITICAL — production outage, PHI exposure risk, Breach Notification Rule obligation, loss of customer confidence (Paul's FTP customer relationship in particular).
• Typical TTPs (MITRE-adjacent):
  • Initial access: credential spray (T1110.003), phishing for OAuth consent (T1528), exposed RDP historically (closed by Twingate-only policy).
  • Execution: beacon binaries in %APPDATA%\Local\Temp (T1059), LOLBins — rundll32, mshta, wscript, regsvr32 (T1218).
  • Persistence: EventID 7045 new service (T1543.003), EventID 4698 scheduled task (T1053.005), registry run keys (T1547.001).
  • Credential access: LSASS memory dump (T1003.001), DCSync against DC (T1003.006).
  • Lateral movement: RDP with stolen creds (T1021.001), Pass-the-Hash (T1550.002), admin shares C$/ADMIN$ (T1021.002).
  • Defense evasion: Clear Security log — EventID 1102 (T1070.001), disable security agents (T1562.001).
  • Exfiltration: RClone, WinSCP, Mega.nz double-extortion (T1567.002).
  • Impact: Ransomware deployment via GPO scheduled task (T1486), shadow-copy deletion (T1490), backup deletion attempts.
• Likely targets in our environment: CJ-2 (AD), CJ-4 (Veeam), CJ-8 (break-glass), ultimately CJ-1 (DDE) or PROD-wide encryption.
• Specific mitigations: Kill-chain agent set (one agent per stage), Cortex XDR behavioral detection, Arctic Wolf act-first MDR, Palo Alto DNS Security, RSV + Object Lock, 4662 SACL for DCSync, quarterly CA policy audit for MFA exclusions (direct lesson from Nov 2024).

Actor 2 — Insider threat (disgruntled admin or privileged user)

• Motivation: Revenge after termination or role change, coerced action under duress, financial gain, or negligence without malicious intent.
• Likelihood: LOW to MEDIUM. Our headcount is small and the personnel are long-tenured; absolute count of potential insiders is low. Any single T1 Domain Admin insider is a CRITICAL threat actor on a per-capita basis.
• Impact: HIGH to CRITICAL depending on role. T1 DA insider (Greg or Kevin-level access) = CRITICAL. Standard user insider = HIGH but bounded.
• Typical TTPs:
  • Legitimate session at the end of employment
  • Bulk data export via sanctioned tools (SharePoint download, DB export via pg_dump)
  • Creating hidden persistence (new service account, new OAuth app, new GPO)
  • Disabling or tampering with security tooling — specifically targeting Cortex XDR, Arctic Wolf, SecOps known-good rules
  • Credential sharing or writing credentials outside Keeper
  • After-hours privileged activity when detection is quieter
• Likely targets in our environment: Whatever the insider's role grants. A SecOps-tier insider threatens CJ-6 (psql-secops-prod) and CJ-5 (Panorama). An AD-tier insider threatens CJ-2 and CJ-1 via GPO. An ops-automation insider threatens CJ-3 (Terraform state).
• Specific mitigations: Entra PIM (nothing standing), quarterly LPRIV audit (compliance/lpriv-*), Keeper PAM session recording, monthly Keeper session review (runbooks/monthly-security-review.md §3), 4-hour termination runbook (compliance/hipaa-administrative-procedures.md §3.3), DLP bulk-egress alerts, UBA baseline (in build), break-glass accounts permanently unsuppressible (detects tampering even by the Security Officer), 6-year immutable audit trail.

Actor 3 — Opportunistic attackers (phishing, credential spray, commodity malware)

• Motivation: Opportunistic financial gain — resell working credentials to RaaS affiliates, run business email compromise, harvest M365 tokens.
• Likelihood: HIGH. There is an active campaign currently probing Cirius identities (observed targets: justinc, gregd, adrianam, paulb, sophien, lauramaeb — per the ongoing identity-agent telemetry noted in CLAUDE.md). This actor is continuously live, not a theoretical future threat.
• Impact: LOW to HIGH. A single successful phishing credential capture is LOW because of Conditional Access + MFA. A successful AiTM capture of an Entra session cookie is HIGH because it bypasses MFA. If those credentials are resold to Actor 1 (RaaS), the follow-on impact is CRITICAL — Actor 3 is the on-ramp for Actor 1.
• Typical TTPs:
  • Password spray against Entra — low-velocity, many-accounts
  • AiTM phishing kits to capture session cookies (evilginx, Tycoon 2FA)
  • OAuth consent phishing — malicious app registration with Graph offline_access
  • Commodity infostealers via malicious attachments / drive-by
• Likely targets in our environment: Any Entra identity, especially service accounts with MFA exclusions, OAuth-consentable scopes on CJ-1 and CJ-2 context.
• Specific mitigations: Conditional Access (block legacy auth, device compliance), SecOps identity agent (credential spray detection, impossible travel, unmanaged-device sign-in), KnowBe4 phishing simulation + training, Maester M365 weekly audit of CA posture, OAuth consent anomaly review, FIDO2 for privileged accounts (in progress — AiTM resistance is the specific mitigation).

Actor 4 — Nation-state (low probability, supply-chain vector most realistic)

• Motivation: Intelligence, long-dwell persistence for future leverage, or collateral damage via supply-chain compromise of a shared vendor.
• Likelihood: LOW for direct targeting of Cirius Group specifically. MEDIUM as a shared-fate vector through vendor compromise (Microsoft, Palo Alto, Cortex, Arctic Wolf, Keeper).
• Impact: CRITICAL if realized. Nation-state capabilities exceed most commercial defense stacks.
• Typical TTPs: SolarWinds-class supply chain, Storm-0558-class token-signing key theft, living-off-the-land, months-to-years dwell, highly targeted custom malware with minimal telemetry, use of legitimate cloud services for C2.
• Likely targets in our environment: CJ-2 (AD), CJ-5 (Panorama — intelligence value), CJ-7 (Key Vaults if keys are extractable).
• Specific mitigations: SHA-pin every GitHub Action, Defender for Cloud anomaly detection, annual vendor attestation review (compliance/vendor-risk-inventory.md), Entra AuditLogs for token-signing anomalies, Arctic Wolf MDR (primary value), defense-in-depth assumption. We do not build nation-state-specific tooling — we rely on vendor ecosystem and hygiene.

Actor summary matrix

Actor	Likelihood	Impact	Primary targets	Key mitigations
1. RaaS affiliate (LockBit, ALPHV, Akira)	HIGH	CRITICAL	CJ-2, CJ-4, CJ-8, CJ-1	Kill-chain agents + Arctic Wolf + Object Lock
2. Insider (disgruntled admin)	LOW-MEDIUM	HIGH-CRITICAL	Role-dependent	PIM + Keeper PAM + LPRIV + UBA
3. Opportunistic (phishing / spray) — ACTIVE	HIGH	LOW-HIGH	Any Entra identity	CA + identity agent + FIDO2 + KnowBe4
4. Nation-state (supply chain)	LOW	CRITICAL	Vendor fabric	SHA-pinning + vendor attestation + defense-in-depth

---

4. STRIDE analysis on crown jewel attack paths (TMOD-003)

We apply STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to each crown jewel. For each cell we document: threat method, current primary control, residual gap (LOW/MEDIUM/HIGH).

CJ-1 — DDE AVD environment

STRIDE	Threat	Current control	Gap
S	AiTM phishing of DDE user session	CA + device compliance; FIDO2 planned for privileged	MEDIUM — FIDO2 pending
S	Service-principal impersonation in DDE tenant	DDE has its own managed identities; no cross-tenant SPs	LOW
T	Published-app configuration tampered to enable data exfil	Admin changes audited; CM ticket required	MEDIUM
R	User denies accessing patient record	M365 audit log + AVD session records	LOW
I	Bulk PHI download from the published app	DLP + M365 audit + UBA (in build) + Arctic Wolf	MEDIUM
I	Screen-scrape / clipboard exfil from AVD session	AVD clipboard policy + device compliance	MEDIUM
D	AVD host pool unavailable	Host pool redundancy; runbook runbooks/incident-response.md	LOW
E	Standard user escalates to session host admin	Session-host local admin restricted; Intune enforces	LOW

CJ-2 — Active Directory forests

STRIDE	Threat	Current control	Gap
S	Pass-the-Hash with stolen DA hash	4624/4648 monitoring; kill-chain lateral-movement agent	HIGH — agent in build
S	Overpass-the-Hash / Pass-the-Ticket	4624/4648 + Kerberos event monitoring	HIGH
T	GPO modification to deploy ransomware	5136/5137 directory events; Maester on-prem baseline	MEDIUM
T	Schema tampering	Schema Admins empty; break-glass only	LOW
R	Adversary clears Security log (EventID 1102)	1102 agent fires CRITICAL immediately; logs already in LAW	LOW (detection guaranteed)
I	DCSync — dumping KRBTGT hash	4662 SACL (scheduled); Cortex XDR behavioral on DCs	HIGH
I	NTDS.dit extraction	File audit + VSS creation monitoring; Cortex XDR	MEDIUM
D	DC crash / replication failure	Multi-DC redundancy; RSV + Veeam backup	LOW
E	Kerberoasting against service accounts	High-entropy passwords; 4769 encryption-type monitoring	MEDIUM
E	Delegation abuse	Maester delegation audit (scheduled)	MEDIUM

CJ-3 — Terraform state

STRIDE	Threat	Current control	Gap
S	Forged OIDC federated identity from Cirius-Group-Inc lookalike	Exact-name OIDC trust (Cirius-Group-Inc) — mismatches fail	LOW
S	Compromised GitHub Action runs with github-deploy-main role	SHA-pin every Action; review every uses: change	MEDIUM
T	State file surreptitiously modified to hide a resource	PR + CI + Rory review; state history in storage; terraform plan diff catches drift	MEDIUM
T	terraform state rm to orphan a resource	Blocked by CI (no local applies); would produce a plan diff	LOW
R	Operator denies applying a change	Every apply is a GitHub Actions run with identity on the commit	LOW
I	Read of state file reveals secret outputs	Provider config avoids sensitive outputs; KV refs instead of inline secrets	MEDIUM
I	State storage account enumerated	Storage firewall, private endpoint where supported	LOW
D	State lock held indefinitely	Lock timeout; manual unlock runbook	LOW
E	A reader SP escalates to state writer	RBAC quarterly review; OIDC identities scoped per-subscription	LOW

CJ-4 — Veeam backup targets

STRIDE	Threat	Current control	Gap
S	Attacker impersonates Veeam service account	Dedicated service account; isolated management network	LOW
T	Backup deletion or encryption	S3 Object Lock (2190d) + RSV immutability are independent of Veeam state	MEDIUM — validated Q2 DR test
R	Operator denies modifying retention	Veeam audit log + SecOps change ticket	LOW
I	Backup image exfil (contains PHI VM snapshots)	Offsite Object Lock + access restricted	MEDIUM
D	Veeam server shutdown or encryption	Object Lock independent path; RSV independent path; monthly restore spot-check	MEDIUM — Q2 DR test validates
E	Veeam admin escalates domain privileges	Veeam service account separate from AD admin tier	LOW

CJ-5 — Palo Alto Panorama

STRIDE	Threat	Current control	Gap
S	Admin takeover	Named admin + MFA; break-glass local per firewall	LOW
T	Attacker alters security policy (allow egress, disable DNS Security)	Panorama audit + syslog to LAW out-of-band + config backup	MEDIUM
T	Decryption policy disabled	Monthly security review §2 checks policy hash	MEDIUM
R	Admin denies making a policy change	Panorama admin audit; SecOps CM ticket required	LOW
I	Panorama config exfil (includes passwords, topology)	RBAC tight; backup credentials rotated (security/palo-alto-backup-credential-rotation.md)	LOW
D	Panorama down	4 independent enforcement nodes with last-known config; local break-glass	LOW
E	Read-only admin escalates to superuser	Role audit in monthly review	LOW

CJ-6 — psql-secops-prod

STRIDE	Threat	Current control	Gap
S	Impersonate SecOps app SP	Entra managed identity; short-lived tokens	LOW
S	Impersonate a human DB admin	Entra AD auth only; no local SQL accounts; Keeper PAM recording	LOW
T	Row-level tampering of evidence / incidents	PITR 35d; backup to Object Lock; pgaudit (in build)	MEDIUM
T	Schema tampering	DDL audited; only infra admin role has DDL rights	LOW
R	Operator denies a change	pgaudit to LAW (pending); app-level user-id on every write	MEDIUM
I	DB dump exfiltration	Private endpoint only; Palo Alto egress; Defender for SQL; DNS Security for C2	LOW
I	Read via stolen app secret	Secrets in Key Vault; rotation schedule; KV access logged	MEDIUM
D	DROP DATABASE / mass delete	Role restrictions; pgaudit to LAW; PITR for restore	MEDIUM
E	App role escalates to DB admin	Separate secops_app role; quarterly LPRIV audit	LOW

CJ-7 — cirius-openai-kv-prod

STRIDE	Threat	Current control	Gap
S	SP impersonation to read secrets	CA on workload identity; short-lived federated credentials	LOW
T	Tampering with secret versions	KV versioning + soft delete + purge protection	LOW
R	Operator denies rotating a secret	KV diagnostic logs to LAW	LOW
I	Secret exfiltration via KV read	Tight RBAC; only named identities; private endpoint where supported	LOW
D	Vault throttling / DoS	Regional redundancy; KV SLA	LOW
E	Reader escalates to Secret Reader	Role-separation audit quarterly	LOW

CJ-8 — Break-glass accounts

STRIDE	Threat	Current control	Gap
S	Unauthorized sign-in	Permanently unsuppressible rule fires CRITICAL; API blocks suppression	LOW
T	Tampering with credential storage	Keeper with split knowledge; physical safekeeping	LOW
R	SO denies a break-glass use	Every use documented; non-repudiable trail	LOW
I	Exfil of credential itself	Physical safekeeping; access-logged Keeper	LOW
D	Account lockout prevents legitimate emergency use	Twice-yearly drill validates account viability	LOW
E	Break-glass is already max privilege	—	—

STRIDE gap summary

Severity	Gaps
HIGH	CJ-2 Pass-the-Hash / Overpass-the-Hash / DCSync (all three agent-pending)
MEDIUM	CJ-1 AiTM + DLP on AVD; CJ-3 Action-compromise + state-read; CJ-4 DR validation; CJ-5 policy tampering; CJ-6 pgaudit; CJ-7 none MEDIUM
LOW	CJ-7 (all), CJ-8 (all except N/A)

---

5. Controls mapped to each attack chain (TMOD-004)

We map controls against both the generic 8-stage ransomware kill chain and the four representative actor-driven attack chains (A–D). This section is the one operational engineers should look at when adding a new detection — find the kill chain stage, find the control gap, close it.

5.1 Kill chain control map (by stage)

Stage	Preventive controls	Detective controls	Gap	Status
1. Initial Access	Entra CA, Twingate ZTA, Palo Alto perimeter, no public management, KnowBe4, patch cadence	SecOps identity agent (spray, impossible travel, unmanaged-device), Palo Alto threat prevention + DNS Security, Maester weekly CA audit, Cortex XDR, Arctic Wolf, Twingate_CL in LAW	FIDO2 not yet deployed for privileged accounts (RA-2026-001)	COVERED
2. Execution	Intune MDM, Cortex XDR behavioral, ASR rules, AppLocker/WDAC on sensitive servers	EventID 4688 process creation, PS 4103/4104 script block, Cortex behavioral (LSASS, unusual parent-child), kill-chain Execution agent (in build)	4688 coverage not complete on all host populations; agent in build	COVERED — active gap
3. Persistence	Limited local admin, GPO startup restrictions, admin-approval required for service install	EventID 7045 (service), 4698 (scheduled task), 5136/5137 (GPO mod), FIM on registry run keys, Persistence agent (in build)	FIM coverage verification in-progress	COVERED — active gap
4. Credential Dumping	Credential Guard, LSASS protection (PPL), no password reuse, Keeper, KRBTGT rotation	4688 + process name lsass, 4624 multi-target auth, 4662 SACL for DCSync (scheduled), Cortex behavioral, Credential-dump agent (in build)	DCSync detection highest-priority gap	COVERED — active gap
5. Lateral Movement	VNet segmentation, Tier 0/1/2 model, admin workstations for privileged sessions	4624/4648 explicit creds, 5140 admin-share access, Palo Alto east-west logs, Lateral-movement agent (in build)	Agent in build; east-west logs complete	COVERED — active gap
6. Exfiltration	Palo Alto App-ID blocks RClone/WinSCP/Mega, DLP on SharePoint/OneDrive, egress allowlist, DNS Security	Palo Alto traffic vs baseline, DNS Security logs, M365 audit for Graph bulk ops, UBA baseline (in build), Exfiltration agent (in build)	UBA + agent active development	COVERED — active gap
7. Defense Evasion	Cortex XDR tamper protection, 6-year WORM archive (can't delete what already shipped), Intune enforces agent presence, DCR to multiple destinations	EventID 1102 (log cleared) — CRITICAL, Cortex silence detection (backlog), agent heartbeat in SecOps, LAW ingestion anomaly (backlog)	Cortex silence escalation in backlog	COVERED — active gap
8. Impact (Encryption)	Cortex XDR behavioral ransomware prevention, Intune device compliance, Veeam + RSV + S3 Object Lock, no attacker path to backup management	Cortex ransomware behavioral, FIM on ransomware paths, Veeam job failure alerts, SecOps mass-delete volume alerts	FIM coverage for ransomware paths to be verified (Q2)	COVERED — active gap

Pattern: preventive coverage is strong across all 8 stages. Detective coverage for stages 2–8 has known gaps, every one of which is on the Q2 kill-chain workstream.

5.2 Attack chain walkthroughs (actor-driven)

Each chain below is an ordered sequence a real attacker would execute. Detection and prevention gates appear at each stage.

Chain A — Ransomware (RaaS affiliate, Nov 2024 pattern)

#	Stage	Attacker action	Control
1	Initial access	Credential spray against Entra, hits service account excluded from MFA	Prevent: quarterly CA audit catches MFA exclusion. Detect: identity agent flags spray + anomalous service-account login.
2	Execution	Beacon binary dropped to %APPDATA%\Local\Temp	Prevent: Cortex XDR behavioral. Detect: 4688 + Execution agent (pending).
3	Credential access	LSASS dump on pivot host, DCSync against DC	Prevent: Credential Guard, LSASS PPL. Detect: 4662 SACL + Credential-dumping agent (pending) + Cortex behavioral.
4	Lateral movement	Pass-the-Hash / RDP to high-value hosts	Prevent: Tier model + admin workstations. Detect: 4624/4648 + Lateral-movement agent (pending).
5	Defense evasion	Clear Security log (1102); attempt Cortex tamper	Prevent: Cortex tamper protection. Detect: 1102 = CRITICAL; Cortex silence (backlog).
6	Impact	Ransomware via GPO scheduled task; encrypt 60+ VMs; target Veeam	Prevent: Object Lock + RSV immutability — encryption is recoverable. Detect: FIM + Cortex ransomware behavioral + Veeam job-failure alerts.

Largest gaps today: stages 2 and 4 (both agent-pending). When Q2 ships: every stage has at least one live detective control.

Chain B — Data theft (Actor 3 → Actor 1 on-ramp, or Actor 2 directly)

#	Stage	Attacker action	Control
1	Initial access	AiTM phishing harvests credentials + session cookie	Prevent: FIDO2 (in progress) — AiTM-resistant. Detect: unmanaged-device sign-in (backlog), Maester CA weekly.
2	Persistence	Register malicious OAuth app with Graph offline_access	Prevent: admin consent required for sensitive scopes. Detect: SecOps identity agent flags anomalous consent.
3	Credential access	Refresh token abuse bypasses password rotation	Detect: Entra AuditLogs + SignInLogs correlation.
4	Discovery	Graph API enumerates M365 business documents, OneDrive, Exchange mailboxes	Detect: Graph API activity in LAW, UBA baseline (in build).
5	Exfiltration	Slow-and-low document pull over days	Prevent: DLP on PHI keywords. Detect: Exfiltration agent + UBA (both in build).

Largest gap today: stage 5 — UBA is the key detection bet; agent in build.

Chain C — Nation-state supply chain (hypothetical)

#	Stage	Attacker action	Control
1	Initial access	Trusted vendor update contains implant (SolarWinds-class)	Prevent: SHA-pin every GitHub Action; vendor attestation review.
2	Execution	Implant runs under trusted process	Detect: Cortex behavioral + Arctic Wolf MDR.
3	Persistence	Stays dormant for weeks	Detect: 7045/4698 (if the implant persists that way); otherwise Arctic Wolf long-dwell analytics.
4	Credential access	Harvests keys slowly	Detect: Entra AuditLogs anomaly (token-signing), KV diagnostic review.
5	Impact	Data theft or positioning	Detect: UBA + Exfiltration agent; Defender for Cloud.

Reality check: detection here relies heavily on vendor telemetry. We accept this — we do not build nation-state-specific tooling.

Chain D — Insider (disgruntled T1 DA or ops-automation insider)

#	Stage	Attacker action	Control
1	Initial access	Legitimate session, last day of employment	Prevent: 4-hour termination runbook. Detect: after-hours privileged activity flag.
2	Discovery	Knows exactly where PHI is	— (unavoidable for trusted role)
3	Exfiltration	Bulk SharePoint download / DB export / Terraform state read	Prevent: DLP + PIM (nothing standing). Detect: DLP bulk-egress alert, Keeper PAM session recording, UBA baseline, pgaudit (in build).
4	Impact	Sold, sent to competitor, published	Detect: 6-year immutable audit trail — tampering detected even if insider is SO (Kevin / Greg execute that audit).

Largest gap today: UBA baseline pending; until live, DLP + Keeper PAM review is the detection.

---

6. Aggregate coverage and residual risk

Stage	Preventive	Detective	Overall
1. Initial Access	STRONG	STRONG	GOOD (FIDO2 gap)
2. Execution	MEDIUM	PARTIAL	GAP (4688 + agent in build)
3. Persistence	MEDIUM	PARTIAL	GAP (FIM + agent)
4. Credential Access	STRONG	PARTIAL	GAP (DCSync detection)
5. Lateral Movement	STRONG	PARTIAL	GAP (agent in build)
6. Exfiltration	STRONG	PARTIAL	GAP (UBA + agent in build)
7. Defense Evasion	STRONG	MEDIUM	GAP (silence escalation)
8. Impact	STRONG	MEDIUM	GAP (FIM verification)

Residual risk register (tracked separately)

Risk	Current state	Target	Tracking
DCSync detection (CJ-2)	PARTIAL	Full coverage via 4662 SACL agent	compliance scorecard
FIDO2 phishing-resistant MFA	IN_PROGRESS	Deployed for all privileged	risk-acceptance-register.md RA-2026-001
IR retainer	GAP	Executed by Q3 2026	risk-acceptance-register.md RA-2026-002
FIM coverage for ransomware paths	IN_PROGRESS	Verified scope + paths	compliance scorecard
Kill-chain agents (exec, persist, cred, lat, exfil)	IN_PROGRESS	Deployed + tuned	CLAUDE.md priorities 2 and 3
Cortex silence escalation	NOT STARTED	Correlation rule	Backlog
pgaudit on psql-secops-prod	IN_PROGRESS	Enabled + DCR to LAW	compliance scorecard
BAA backlog (4 vendors)	IN_PROGRESS	All IN_FORCE	vendor-risk-inventory.md

---

7. Recommendations

In priority order:

1. Complete kill-chain Phase 1 + Phase 2 (CLAUDE.md priorities 2 and 3). This single workstream closes detection gaps at stages 2–7 simultaneously. Highest-leverage investment of 2026.
2. Deploy FIDO2 for all privileged accounts by Q3 2026. Direct mitigation for Actor 3 → Actor 1 on-ramp. AiTM-resistant auth eliminates the credential-phishing vector against highest-value identities.
3. Execute IR retainer before SOC2 audit (September 2026). Currently GAP status.
4. Enable pgaudit on psql-secops-prod (Q2 2026). Closes CJ-6 tampering and repudiation gap.
5. Verify FIM coverage and monitored paths (Q2 2026). Tightens Stage 3 and Stage 8 detection.
6. Q2 DR test validates Veeam vs RSV vs S3 independence for CJ-4. Tabletop the Chain A ransomware scenario end-to-end first (compliance/ir-tabletop-scenario-2026.md) so lessons inform the live restore.
7. Close the BAA backlog (Arctic Wolf, Keeper, Twingate, Cortex) before September audit.
8. Cortex silence escalation rule — get off the backlog, build the correlation. Stage 7 gap.

---

8. Cross-references

• Crown-jewel detail files (if retained as supporting docs):
  • security/threat-model/crown-jewels.md
  • security/threat-model/threat-actors.md
  • security/threat-model/stride-analysis.md
  • security/threat-model/controls-mapping.md
• Operational runbooks:
  • runbooks/incident-response.md
  • runbooks/kill-chain-audit-policy.md
  • runbooks/monthly-security-review.md
  • runbooks/year-end-checklist.md (annual threat model review — §6 of that runbook)
• Compliance and risk:
  • compliance/compliance-scorecard.md
  • compliance/risk-acceptance-register.md
  • compliance/ir-tabletop-scenario-2026.md
  • compliance/q2-dr-test-plan-2026.md
  • compliance/q4-dr-test-plan-2026.md
• Architecture context: CLAUDE.md (operating instructions), README.md

This threat model is the canonical single-document reference. Every security project, detection agent, tabletop scenario, and compliance artifact should be traceable back to a crown jewel, an actor, and a kill-chain stage defined here. If it does not trace back, it is either missing from this document (file an update) or not justified (file a known-risk exception).

---

9. Ready-for-review note (TMOD-006)

This document is READY FOR REVIEW by Greg and Kevin.

Both are T1 Domain Admins (DR) and serve as the escalation path / consumers of compliance reports for Cirius Group. Their specific review tasks:

• Greg: confirm Actor 1 (RaaS) mitigations match your view of the November 2024 incident. Confirm Chain A walkthrough reflects reality.
• Kevin: confirm Actor 2 (insider) mitigations are sufficient for the scenario where the SO (Rory) is the insider. Confirm the 6-year immutable audit trail under §4 Chain D step 4 is what you would rely on to execute the reverse-audit.
• Both: confirm the crown jewel ranking (§2) matches your priority ordering. Note any asset you would add, remove, or re-rank.
• Both: confirm Recommendations §7 prioritization. If you would reorder, capture why.

Rory is the document owner. Sign-off flow: Greg + Kevin review → Rory merges feedback → next annual review in December 2026.

Review tracking: this document's presentation to Greg and Kevin is tracked under SecOps story TMOD-006 (closed at publication of this version).

---

10. Review schedule (TMOD-005, TMOD-007)

Annual review cadence

This is a living document. It is reviewed annually in December. Additionally, a mid-cycle review is triggered by any of:

• Any material security incident (by our definition, any incident where SecurityAgent fires CRITICAL and the incident reaches OPEN status)
• Material environment change — new tenant, new AWS account, new crown-jewel-class asset
• New threat actor emerges that materially changes the threat landscape for healthcare SMBs
• New regulatory obligation (e.g., HIPAA amendment, state privacy law update)
• Third-party pen test or audit finding that invalidates an assumption

Annual review checklist (runs in December)

Full steps live in runbooks/year-end-checklist.md §6. The threat model annual review specifically requires:

1. Re-confirm crown jewel inventory — add / remove / re-rank as needed
2. Refresh threat actor profiles — incorporate new RaaS group branding, new campaign intelligence, any insider personnel change
3. Re-walk the four attack chains — any new TTPs seen this year? Any old TTPs closed by a new control?
4. Re-score every STRIDE cell — gaps that were HIGH a year ago should be LOW if the corresponding agent is live; any new gap must be registered in compliance/risk-acceptance-register.md
5. Re-score the eight kill-chain stages in §5.1
6. Update Recommendations §7 — remove done items, add new ones
7. Update "Last reviewed" date at the top and add a row to the Document history table
8. Present refreshed version to Greg and Kevin; capture sign-off

Referenced-by contract

This document is referenced by, and therefore must stay current for, the following projects:

• Kill-chain detection workstream — agent design pulls expected TTPs from §3
• SecOps identity agent — spray / consent / unmanaged-device detections derive from Actor 3
• SOC2 audit prep — §2 crown jewels, §4 STRIDE, §5 controls map are direct audit evidence
• IR tabletops — §5.2 Chain A is the baseline ransomware scenario
• DR tests — §5 Stage 8 + CJ-4 backup independence is the recovery assertion under test
• New security projects — Rory's gate before accepting a new security project is "which crown jewel / stage / actor does this close a gap for?" — the answer must reference §2, §5, or §3 in this file

Document history

Date	Change	Author
April 2026	Initial consolidated v1 — crown jewels, actors, STRIDE, controls, review schedule; ready for Greg / Kevin review	Kobe (TMOD-001 through TMOD-007)