The increasing scale of computer network systems has also exposed more security weaknesses. Traditional threat detection and assessment methods, such as penetration testing and code auditing, rely on manual operations and are difficult to cope with the complexity of the network environment. In contrast, attack graph-based threat modeling methods have advantages such as automation and visualization and are more suitable for large and complex network environments. Attack path assessment based on probabilistic transfer can reasonably and efficiently reflect potential high-risk paths. However, the performance granularity based on logical attack graph in existing research mainly focuses on vulnerability exploitation, lacks fine-grained features such as attack behaviour, and is difficult to meticulously restore the attack scenarios, which also makes it difficult for security personnel to assess the potential risks of attack paths accurately. This paper proposed a threat modeling and assessment framework based on logical attack graphs for weak password attacks. The framework generates attack paths based on MulVAL. Firstly, maps ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) techniques and tactics into inference rules to restore the attack chain with fine-grained attack behaviors. Secondly, we introduce metrics such as cipher entropy to quantify the risk of weak passwords in the attack chain when assessing the risk of techniques and tactics in the attack chain. Finally, a forward propagation mechanism is introduced to calculate the risk probability of the attack chain. We experimentally demonstrate the effectiveness of the method.