Malware and EDR

The attack: Malware

Malware is the name for all malicious software: trojans, worms, ransomware, keyloggers, rootkits, spyware. Once running on a computer it can steal data, encrypt files to demand a ransom, open a hidden way in or spread to other machines. It often arrives as a harmless-looking attachment or download, or an attacker installs it after a first break-in.

The defence: EDR

EDR (Endpoint Detection and Response) is the evolution of antivirus: instead of only looking for signatures of known malware, it watches how programs behave on every computer and server (processes encrypting thousands of files, suspicious connections, system changes) and can isolate the machine or stop the process. Together with antivirus and the work of a SOC it is the main defence against malware.

What stops what

• EDR against Malware: half damage. Malware has to run on a computer, and that is exactly where EDR watches its behaviour and blocks it.
• Malware against Training: double damage. Once running, malware acts and spreads on its own: it no longer asks anyone for permission.
• Malware against Firewall: double damage. The malware is already inside the network and talks over allowed ports, blended into normal web traffic.
• Scanning against EDR: double damage. EDR watches programs on computers, while the scan comes from outside and probes network services.
• DDoS against EDR: double damage. A wave of traffic runs no program on the computers: for EDR there is nothing to block.

In every other match-up damage is normal.

Combos with Malware

• Delivery (Phishing → Malware, +2 damage): the bait message carries the malware inside, as in most real infections.
• Escalation (Exploit → Malware, +2 damage): an exploited flaw opens the way to installing malware.
• Persistence (Malware → Malware, +1 damage): malware that is already installed downloads and hides more of it.

Malware attack cards (19)

Trojan

#007 · Attack · Malware · ◆2 · power 3 · Common · Arena 1 (Laboratory)

A program that looks harmless but opens the door to the attacker.

Keylogger

#018 · Attack · Malware · ◆1 · power 1 · Common · Arena 1 (Laboratory)

Records every keystroke. For 2 turns the opponent loses 1 integrity at the start of their turn.

Worm

#009 · Attack · Malware · ◆4 · power 5 · Rare · Arena 3 (Data center)

Malware that spreads by itself from machine to machine. You draw a card.

Backdoor

#022 · Attack · Malware · ◆3 · power 3 · Rare · Arena 3 (Data center)

A hidden way in left on the system. For 3 turns the opponent loses 1 integrity at the start of their turn.

Cryptojacking

#031 · Attack · Malware · ◆2 · power 2 · Common · Arena 3 (Data center)

The opponent has 1 less bandwidth for 2 turns.

Rootkit

#032 · Attack · Malware · ◆4 · power 4 · Rare · Arena 4 (SOC)

For 4 turns the opponent loses 1 integrity at the start of their turn.

Fileless malware

#097 · Attack · Malware · ◆3 · power 4 · Rare · Arena 4 (SOC)

Lives only in memory and writes no files to disk, so signature-based antivirus struggles to see it. Enemy defenses in play lose all abilities while they stay in play.

Ransomware as a service

#100 · Attack · Malware · ◆5 · power 6 · Epic · Arena 4 (SOC)

Ransomware for rent: developers and affiliates split the ransom. Also deals 2 direct damage to the core; for 3 turns, enemy defenses lose 1 toughness at the start of their turn.

Beaconing

#186 · Attack · Malware · ◆2 · power 2 · Common · Arena 4 (SOC)

The malware calls its command server at regular intervals: that very regularity gives it away in the logs. For 2 turns the opponent loses 1 integrity at the start of their turn.

EDR evasion

#191 · Attack · Malware · ◆3 · power 3 · Rare · Arena 4 (SOC)

Techniques to stay out of sight of the endpoint sensor: against them you need an EDR that watches behavior, not just signatures. The weakest enemy defense loses 2 toughness.

Ransomware

#008 · Attack · Malware · ◆5 · power 7 · Epic · Arena 6 (Dark web)

Encrypts files and demands a ransom. Also hits the core directly.

Infostealer

#204 · Attack · Malware · ◆2 · power 2 · Common · Arena 6 (Dark web)

Malware that carries off the passwords and cookies saved in the browser. Countered by MFA, short sessions and no passwords stored in the browser. Draw a card.

Double extortion

#209 · Attack · Malware · ◆6 · power 8 · Epic · Arena 6 (Dark web)

Besides encrypting the data, they copy it and threaten to publish it. Prepared for with disconnected backups and data encrypted at rest. Also deals 2 direct damage to the core and the opponent discards 1 random card.

Self-spreading worm

#212 · Attack · Malware · ◆6 · power 7 · Legendary · Arena 6 (Dark web)

It spreads by itself across the whole internal network through an unpatched hole: segmentation and patching stop it. 2 damage to every enemy defense and 2 direct damage to the core.

SCADA sabotage

#220 · Attack · Malware · ◆7 · power 8 · Legendary · Arena 7 (Cyber range)

Malware alters a plant’s controllers while the panels show normal values. Prevented with segregated OT networks and verified firmware. Ignores countermeasures and deals 2 damage to every enemy defense.

Wiper

#033 · Attack · Malware · ◆7 · power 9 · Epic · Arena 8 (Zero-day)

The opponent discards 2 random cards.

Kernel rootkit

#171 · Attack · Malware · ◆5 · power 5 · Epic · Arena 8 (Zero-day)

Malware nesting in the heart of the operating system and switching off whatever should control it. Dissolves one of the opponent’s spells (the most expensive) and the strongest enemy defense loses 1 toughness.

Dependency confusion

#227 · Attack · Malware · ◆5 · power 5 · Epic · Arena 8 (Zero-day)

A public package with the same name as an internal one gets installed in its place. Avoided with private registries given priority and pinned versions. For 4 turns the opponent loses 1 integrity at the start of their turn; also 1 damage to all their defenses.

Firmware implant

#229 · Attack · Malware · ◆7 · power 8 · Legendary · Arena 8 (Zero-day)

A program hidden in the firmware survives reinstalls and disk swaps. Prevented with secure boot and signed, measured firmware. For 4 turns the opponent loses 1 integrity at the start of their turn; their defenses in play lose all abilities.

EDR defence cards (6)

Antivirus

#047 · Defense · EDR · ◆2 · toughness 4 · Common · Arena 1 (Laboratory)

Recognises known malware by its signatures.

Sandbox

#062 · Defense · EDR · ◆3 · toughness 4 · Rare · Arena 3 (Data center)

Regenerate: +1 toughness at turn start.

Backup room

#102 · Defense · EDR · ◆2 · toughness 3 · Common · Arena 3 (Data center)

A protected room where copies of the data wait to be restored. Heals the core: +1 integrity at turn start.

Immutable backup

#183 · Defense · EDR · ◆3 · toughness 4 · Rare · Arena 3 (Data center)

A copy that not even a compromised administrator can delete or encrypt: the antidote to ransomware. Heals the core: +1 integrity at turn start. Regenerate: +1 toughness at turn start.

EDR

#048 · Defense · EDR · ◆4 · toughness 8 · Epic · Arena 4 (SOC)

Endpoint Detection & Response: watches behaviour and stops new malware too.

XDR

#067 · Defense · EDR · ◆7 · toughness 11 · Legendary · Arena 8 (Zero-day)

Regenerate: +2 toughness at turn start.

The other card groups

• Phishing and Training
• Exploit and Patch
• Brute force and MFA
• Scanning and IDS
• DDoS and Firewall
• Support cards
• Terrains
• Traps
• Spells

All cards and the type chart