Scanning and IDS

The attack: Scanning

Scanning is reconnaissance: finding out which machines are up on a network, which ports are open, which services and versions answer. Tools like nmap make this quick. A scan on its own breaks nothing, but it is almost always the first step of an attack: it tells the attacker where to look and which vulnerabilities to search for.

The defence: IDS

An IDS (Intrusion Detection System) analyses network traffic or system events and flags what looks like an attack: port scans, signatures of known exploits, unusual behaviour. On its own it only raises the alarm (an IPS can also block); its value is in alerting defenders early, often already during reconnaissance, while the attacker is still looking around.

What stops what

• IDS against Scanning: half damage. Scans leave recognisable traces in the traffic, which is exactly the job an IDS is built for.
• Scanning against MFA: double damage. A scan does not try to log into any account, it only looks at what answers: the second factor is irrelevant.
• Scanning against EDR: double damage. EDR watches programs on computers, while the scan comes from outside and probes network services.
• Brute force against IDS: double damage. Each attempt is a regular login on the right page: a slow, distributed attack looks like normal traffic.
• DDoS against IDS: double damage. The IDS sees the attack and raises the alarm, but detecting it is not enough: the connection stays clogged anyway.

In every other match-up damage is normal.

Combos with Scanning

• Kill chain (Scanning → Exploit or Brute force, +2 damage): first you find out what is exposed, then you attack the weak spot you found.
• Reconnaissance (Scanning → Phishing, +2 damage): knowing who works where and with which systems makes phishing believable.

Scanning attack cards (7)

Ping sweep

#012 · Attack · Scanning · ◆1 · power 1 · Common · Arena 1 (Laboratory)

Finds which machines are up in a network. Little damage, but information: you draw a card.

Port scan

#037 · Attack · Scanning · ◆0 · power 1 · Common · Arena 1 (Laboratory)

Costs nothing: handy to start a combo.

Vulnerability scanner

#038 · Attack · Scanning · ◆2 · power 2 · Rare · Arena 1 (Laboratory)

Take the first attack from your deck.

Aggressive Nmap

#013 · Attack · Scanning · ◆3 · power 4 · Rare · Arena 2 (Corporate network)

Full scan of ports, services and versions. You draw a card.

Banner grabbing

#020 · Attack · Scanning · ◆1 · power 1 · Common · Arena 2 (Corporate network)

Reads the version of exposed services. For 2 turns enemy defenses take +1 damage.

Shodan

#039 · Attack · Scanning · ◆4 · power 3 · Epic · Arena 4 (SOC)

Draw 2 cards and enemy defenses are exposed for 2 turns.

Public bucket

#195 · Attack · Scanning · ◆1 · power 1 · Common · Arena 5 (Cloud)

A cloud storage left open to everyone: an address and a browser are all it takes. Avoided with private access by default and configuration checks. Also deals 1 direct damage to the core.

IDS defence cards (11)

Signature IDS

#051 · Defense · IDS · ◆2 · toughness 4 · Common · Arena 1 (Laboratory)

Intrusion Detection System: spots known scans and attacks in the traffic.

Log review

#057 · Defense · IDS · ◆1 · toughness 2 · Common · Arena 1 (Laboratory)

Someone actually reads the logs every morning. Odd things get noticed.

Honeypot

#060 · Defense · IDS · ◆2 · toughness 3 · Rare · Arena 1 (Laboratory)

Counterattack: whoever hits it loses 2 integrity.

24/7 SOC

#052 · Defense · IDS · ◆5 · toughness 9 · Epic · Arena 4 (SOC)

A team watching alerts and logs day and night.

Endpoint telemetry

#188 · Defense · IDS · ◆2 · toughness 3 · Common · Arena 4 (SOC)

Every process started on a computer is recorded and sent to the analysts: nothing stays hidden for long. Counterattack: whoever hits it loses 1 integrity.

Event correlation

#192 · Defense · IDS · ◆3 · toughness 4 · Rare · Arena 4 (SOC)

A thousand harmless log lines, put together, tell the story of an attack: that is the SIEM’s job. Attrition: at turn start the strongest enemy defense loses 1.

Decoy sensor

#106 · Defense · IDS · ◆3 · toughness 4 · Rare · Arena 5 (Cloud)

A sensor posing as a real server: whoever touches it gives themselves away and gets logged. Counterattack: whoever hits it loses 1 integrity. Regenerate: +1 toughness at turn start.

Automated SOC

#108 · Defense · IDS · ◆5 · toughness 7 · Epic · Arena 5 (Cloud)

Analysts and automation (SOAR) detect and respond within seconds. Regenerate: +1 toughness at turn start. Attrition: at turn start the strongest enemy defense loses 1.

Deception grid

#066 · Defense · IDS · ◆6 · toughness 8 · Legendary · Arena 6 (Dark web)

Counterattack: whoever hits it loses 3 integrity.

Guardrails for language models

#226 · Defense · IDS · ◆3 · toughness 4 · Rare · Arena 8 (Zero-day)

Filters on inputs and outputs, minimal permissions and a log of what the model does. Regenerate: +1 toughness at turn start. Armor: −1 to every hit taken.

Autonomous defensive AI

#230 · Defense · IDS · ◆7 · toughness 10 · Legendary · Arena 8 (Zero-day)

A system that learns normal behavior and reacts on its own, always with a person who can stop it. Counterattack: whoever hits it loses 2 integrity. Regenerate: +1 toughness at turn start. Attrition: at turn start the strongest enemy defense loses 1.

Related guides

• What is a CTF and how to get started

The other card groups

• Phishing and Training
• Exploit and Patch
• Malware and EDR
• Brute force and MFA
• DDoS and Firewall
• Support cards
• Terrains
• Traps
• Spells

All cards and the type chart