Every defence and every threat, with the stats the simulation actually runs on. Threat numbers are the wave-one baseline; health and bounty scale up as a run progresses.
Threats map to MITRE ATT&CK techniques and defences to MITRE D3FEND countermeasures, using the same dataset that powers MITRE ATT&CK Adventure. Nothing here is invented: if a threat has no D3FEND coverage, this page says so rather than guessing.
Same seven D3FEND tactics the Adventure’s Defender seat uses: Model, Harden, Detect, Isolate, Deceive, Evict, Restore. A firewall here is Isolate there; a honeypot is Deceive in both.
A threat that has already been engaged by several different kinds of control takes more damage from the next one. Ten firewalls are one layer. A firewall, an IDS and an encryption field are three.
+9% per extra layer, up to ×1.36 at 5 layers
The small marks above a threat’s health bar count the layers it has taken so far. This is the main reason a varied board beats a bigger uniform one.
More sensors means more alerts, and past a point less attention paid to any one of them. Detectors past the 3rd dilute the strength of every flag on the board. Detection itself never fails; only the damage bonus weakens.
Three upgraded sensors beat ten cheap ones, which is the right answer here and in a real detection programme.
Stateful packet filtering. Cheap, fast, and always the first thing you stand up. Struggles against hardened payloads.
Signature-based scanning with a quarantine burst. Clears clustered, low-health swarms faster than anything else.
Intrusion detection. Reveals stealthed threats in range and flags what it hits so every other tower hurts more.
Forces every packet through a crypto handshake. Low damage, but the throughput penalty stacks up across a whole lane.
A deliberately soft target. Pulls threats toward it, poisons them slowly, and turns every kill nearby into extra budget.
Endpoint agents sharing telemetry. A detection on one host propagates to its neighbours, arcing between clustered threats.
Analysts feeding targeting data to everything around them. Deals no damage itself, and makes every neighbour hit harder and faster.
A model that learns the target it is shooting at. Slow, expensive, enormous range, and it ramps up the longer it stays locked on. The answer to anything with too much health to burst down.
| Threat | Health | Speed | Armour | Core dmg | Bounty | From wave | ATT&CK |
|---|---|---|---|---|---|---|---|
Virus Self-replicating code riding a host file. The baseline nuisance: no armour, no tricks. | 55 | 1.5 | 0 | 1 | 9 | 1 | T1204.002 User Execution: Malicious File Runs because somebody opened it. |
Worm Propagates on its own across the network. Fast and fragile, and it never comes alone. | 38 | 2.6 | 0 | 1 | 7 | 2 | T1091 Replication Through Removable Media Spreads on its own, without anyone opening anything. |
Phishing Payload A convincing lure clicked by a real user. Almost no health, but it sprints for the core. | 26 | 3.2 | 0 | 1 | 6 | 3 | T1566.002 Phishing: Spearphishing Link A convincing lure, clicked by a real person. |
Trojan Hides inside something you asked for. Lightly armoured, so chip damage bounces off it. | 110 | 1.2 | 2 | 2 | 14 | 4 | T1027.002 Obfuscated Files or Information: Software Packing Packed so the thing you scan is not the thing that runs. |
Ransomware Encrypts everything it touches. Slow, heavily armoured, and devastating if it reaches the core. Needs burst damage, not chip damage. | 260 | 0.85 | 6 | 3 | 32 | 5 | T1486 Data Encrypted for Impact Encrypts what it reaches and asks to be paid. |
Cryptominer Does not want to break anything. It wants your compute, and it drains budget every second it survives. | 130 | 1.3 | 1 | 1 | 20 | 6 | T1496 Resource Hijacking Wants your compute, not your data. |
DDoS Packet Volumetric flood traffic. Individually trivial, collectively overwhelming. Bring splash damage. | 20 | 2.2 | 0 | 1 | 2 | 7 | T1498.001 Network Denial of Service: Direct Network Flood Volume as the weapon. |
Botnet Node A command-and-control hub. Killing it scatters the bots it was coordinating. | 190 | 1 | 3 | 2 | 24 | 8 | T1583.005 Acquire Infrastructure: Botnet A rented crowd of compromised hosts. |
Zombie Host An orphaned bot with no controller left. Only appears when a botnet node is destroyed. | 30 | 1.9 | 0 | 1 | 3 | — | T1105 Ingress Tool Transfer The payload pulled down onto each conscripted host. |
Rootkit Operates below the OS. Completely invisible, and untargetable, until a detector lights it up. | 150 | 1.15 | 4 | 2 | 28 | 10 | T1014 Rootkit Sits below the layer doing the looking. |
Encrypted Tunnel Exfiltration over TLS. Ignores your network topology entirely and flies straight at the core. | 120 | 1.4 | 2 | 2 | 26 | 12 | T1572 Protocol Tunneling Exfiltration wrapped in traffic you already allow. |
Logic Bomb Dormant until its trigger fires. Hits the core hard, and accelerates the closer it gets to dying. | 180 | 1.6 | 2 | 5 | 30 | 14 | T1053 Scheduled Task/Job Dormant until its trigger condition fires. |
APT Implant A funded, patient adversary. Shielded, self-healing, and it will outlast anything that cannot burst it down. | 420 | 1.05 | 8 | 4 | 58 | 16 | T1078 Valid Accounts Not breaking in. Logging in, and staying. |
Zero-Day Exploit No signature exists. No patch exists. It is immune to throttling and it does not care about your rule sets. | 1700 | 0.75 | 9 | 15 | 420 | — | T1068 Exploitation for Privilege Escalation No signature exists yet, because nobody has seen it. |