ARTIFACTS

D3FEND

Top Level Artifacts

Digital Artifact

Address Space

Memory Extent

Shadow Stack

Thread

Memory Address

Page Table

Software Package

User

User Account

User Action

User Behavior

User Interface

User to User Message

Volume

Dependency

Link

Binary Large Object

Binary Segment

Blob

Block Device

Boot Loader

Call Stack

Certificate

Clipboard

Command

Credential

Cryptographic Key

Database

Decoy Artifact

Digital System

Directory

Display Server

DNS Lookup

Domain Registration

Enclave

File Selection

File System

File System Link

Hardware Device

Hardware Driver

Identifier

Interprocess Communication

Intrusion Detection System

Kernel Process Table

Log

Metadata

Network

Network Flow

Network Node

Network Traffic

Operating System

Partition

Partition Table

Physical Location

Platform

Pointer

Process

Process Image

Process Tree

Record

Resource

Sensor

Session

Software

Stack Component

Storage

System Call

Task Schedule

Trust Store

Files

File

Archive File

Java Archive

Custom Archive File

Certificate File

CA Certificate File

Configuration File

Operating System Configuration File

Property List File

User Init Configuration File

Application Configuration File

Compiler Configuration File

Container Image

Document File

HTML File

Office Application File

Email

Email Attachment

Multimedia Document File

Executable File

Executable Binary

Executable Script

Init Script

Network Init Script File Resource

User Init Script

PowerShell Profile Script

Python Script File

System Init Script

User Startup Script File

Web Script File

Password File

Symbolic Link

Fast Symbolic Link

NTFS Junction Point

NTFS Symbolic Link

POSIX Symbolic Link

Slow Symbolic Link

Alias

NTFS Link

NTFS Hard Link

Software Library File

Log File

Operating System Log File

Command History Log File

Object File

Kernel Module

Shared Library File

Operating System Shared Library File

Operating System File

Operating System Executable File

Shortcut File

Windows Shortcut File

Database File

Network Traffic

Network Packets

Network Session

Remote Command

Remote Procedure Call

Remote Database Query

Remote Terminal Session

Outbound Network Traffic

Outbound Internet DNS Lookup Traffic

Outbound Internet File Transfer Traffic

Outbound Internet Network Traffic

Outbound Internet Web Traffic

Outbound Internet Encrypted Web Traffic

Outbound Internet Encrypted Traffic

Outbound Internet Encrypted Remote Terminal Traffic

Outbound Internet Mail Traffic

Outbound Internet RPC Traffic

RPC Network Traffic

Intranet RPC Network Traffic

Web Network Traffic

Intranet Web Network Traffic

IPC Network Traffic

Intranet IPC Network Traffic

Mail Network Traffic

Inbound Internet Mail Traffic

Administrative Network Traffic

Intranet Administrative Network Traffic

DNS Network Traffic

File Transfer Network Traffic

Internet File Transfer Traffic

Intranet File Transfer Traffic

Inbound Network Traffic

Inbound Internet Network Traffic

Inbound Internet DNS Response Traffic

Internet Network Traffic

Intranet Network Traffic

Intranet Multicast Network Traffic

Local Area Network Traffic

Software

Software Library

Shim

Application Shim

Software Patch

Subroutine

Exception Handler

Input Function

User Input Function

Stored Procedure

Authentication Function

Console Output Function

Copy Memory Function

Deserialization Function

Eval Function

External Content Inclusion Function

File Path Open Function

Import Library Function

Log Message Function

Mathematical Function

Memory Allocation Function

Memory Free Function

Pointer Dereferencing Function

Process Start Function

Raw Memory Access Function

Serialization Function

Shared Resource Access Function

String Format Function

Thread Start Function

System Service Software

Local Authorization Service

Task Scheduler Software

Local Authentication Service

System Software

Host-based Firewall

Kernel

Utility Software

System Time Application

Network Agent

Application

Client Application

Password Manager

Service Application

Software Deployment Tool

Virtualization Software

Container Orchestration Software

Container Runtime

Credential Management System

Web Server Application

User Application

Office Application

Browser

Browser Extension

Collaborative Software

Business Communication Platform Client

Chatroom Client

Instant Messaging Client

Developer Application

Build Tool

Compiler

Software Packaging Tool

Container Build Tool

Operating System Packaging Tool

Code Analyzer

Dynamic Analysis Tool

Static Analysis Tool

Source Code Analyzer Tool

Test Execution Tool

Integration Test Execution Tool

Unit Test Execution Tool

Version Control Tool

Network Traffic Analysis Software

Application Installer

Firmware

Microcode

Peripheral Firmware

Graphics Card Firmware

Hard Disk Firmware

Human Input Device Firmware

Network Card Firmware

Peripheral Hub Firmware

System Firmware

File

A file maintained in computer-readable form.

ID: d3f:File

ⓘ

Type: Files

Informational References

https://d3fend.mitre.org/dao/artifact/d3f:File/

D3FEND Techniques

Name	Description
D3-PH	Hardening components of a Platform with the intention of making them more difficult to exploit. Platforms includes components such as: * BIOS UEFI Subsystems * Hardware security devices such as Trusted Platform Modules * Boot process logic or code * Kernel software components
D3-FE	Encrypting a file using a cryptographic key.
D3-LFP	Restricting access to a local file by configuring operating system functionality.
D3-FA	File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.
D3-FCR	Employing a pattern matching rule language to analyze files.
D3-FH	Employing file hash comparisons to detect known malware.
D3-DO	A Decoy Object is created and deployed for the purposes of deceiving attackers.
D3-DF	A file created for the purposes of deceiving an adversary.
D3-FEV	File eviction techniques evict files from system storage.
D3-FR	The file removal technique deletes malicious artifacts or programs from a computer system.

SPARTA Countermeasures

ID	Name	Description
CM0049	Machine Learning Data Integrity	When artificial intelligence (AI) or machine learning (ML) is employed for mission-critical spacecraft or ground system operations, the integrity of the training data set is a foundational security requirement, not merely a data quality concern. Data poisoning attacks introduce or modify training samples, labels, or other data-pipeline inputs to alter resulting model behavior. Poisoning may cause general performance degradation, targeted misclassification, or backdoor behavior that appears only when specific operational inputs or triggers are present. Remediation may require identifying and removing affected data, retraining or fine-tuning from a trusted dataset, or rolling back to a validated model. Because remediation can be difficult and may not identify every affected behavior, controls should prioritize preventing unauthorized data changes and detecting suspicious inputs before training while maintaining recoverable trusted dataset and model versions. Detection and prevention techniques include validity checking of data sets to identify statistically anomalous or out-of-distribution inputs, statistical analysis to detect injected samples that deviate from expected data distributions, manual analysis of flagged inputs, and regression testing over time to identify model behavioral drift that may indicate successful historical poisoning. These controls must be applied as part of a continuous data governance process spanning the full training pipeline, from data collection and curation through model validation and operational deployment.
CM0013	Dependency Confusion	Dependency confusion is a software supply chain attack in which an adversary publishes a malicious package to a public repository using the same name as an organization's internal private package, exploiting build tools that may inadvertently resolve the public version over the intended internal one. Mitigating this attack requires a layered set of controls: internal dependencies must be sourced exclusively from private, controlled repositories rather than public package registries; build and continuous integration and continuous delivery (CI/CD) pipeline configurations must explicitly define trusted repository sources and resolution order to prevent inadvertent public package substitution; and dependency integrity must be validated at the point of consumption by verifying that cryptographic checksums match those of the known-good official packages. A secure build environment is a prerequisite for these controls to be effective, as a compromised build environment can undermine dependency controls regardless of repository configuration. Together, these measures ensure that only verified, intended dependencies are incorporated into flight software, ground system software, and supporting toolchains.
CM0017	Coding Standard	A formally defined coding standard establishes the rules, conventions, and constraints that govern how software is written across the mission's development program, directly influencing the security, maintainability, and verifiability of the delivered system. The standard must specify acceptable programming language types, with language selection driven by a documented evaluation of security requirements, application complexity, scalability needs, available development resources, schedule constraints, and the availability of security-relevant language features such as memory safety, type safety, and bounds checking. Language choices that introduce classes of vulnerability by design, such as languages without memory safety guarantees used in contexts where memory corruption is a plausible attack vector, require explicit justification and compensating controls. The coding standard must include security-relevant rules for input validation, error handling, cryptographic usage, memory management, and concurrency, as applicable to the selected languages and system design. Adherence should be evaluated through automated means where supported, supplemented by manual review for requirements that cannot be reliably automated.
CM0039	Least Privilege	The principle of least privilege requires that every process, user account, service, and system component be granted only the permissions and access rights necessary to perform its defined function, with no additional privileges retained beyond what the assigned task requires. Applied to spacecraft and ground systems, this means that processes executing on flight computers, operating system services, ground system applications, and inter-system communication handlers are each confined to the minimum privilege level needed for their specific function, preventing a compromised or malfunctioning component from leveraging excess permissions to affect other system resources or functions. Separate execution domains should be used where supported to reinforce least privilege and contain process failures or compromise. Process isolation does not replace explicit access controls, because authorized communication and shared resources may still cross execution-domain boundaries. Least privilege is a foundational design principle that reduces the consequence of any individual component compromise by limiting what an adversary can accomplish within that component's execution context.
CM0067	Smart Contracts	Smart contracts provide an automated, consensus-based enforcement mechanism for security protocols governing data exchange across a spacecraft bus, particularly in hosted payload architectures where multiple independently operated payloads or subsystems share common infrastructure. By encoding security rules as deterministic contract logic, participating validator nodes can evaluate authenticated observations of bus activity and reach consensus on whether a defined violation occurred. A trusted bus controller, gateway, or access-control mechanism must then enforce any approved restriction because the smart contract itself cannot directly observe or block physical bus traffic. This approach is directly applicable to scenarios where a hosted payload is compromised or behaves maliciously, as the smart contract framework can detect the violation, achieve consensus among the remaining bus participants, and enforce exclusion of the offending payload before the attack propagates to other bus components or the host spacecraft. The consensus mechanism should prevent a single participating node from causing payload exclusion when the approved quorum and membership rules require agreement from multiple independent validators. Its effectiveness depends on the validator architecture, quorum threshold, communication assumptions, and number of compromised or unavailable validators. Smart contract-based enforcement is particularly valuable in multi-tenant spacecraft architectures where payload operators are organizationally distinct from the spacecraft bus operator and cannot be governed through a single chain of administrative control.
CM0014	Secure boot	Secure boot establishes and enforces a cryptographically verified chain of trust from a hardware-anchored root of trust (RoT) through each applicable stage of the startup sequence to the operating system or flight software image. Each stage in the chain must verify the integrity and authenticity of the next before transferring execution control. The boot policy must also prevent execution of unauthorized or revoked images, including unauthorized rollback to an older but validly signed software version. The trust anchor and initial verification function should be immutable after provisioning or protected by hardware-enforced mechanisms that prevent unauthorized modification and preserve their integrity. Components implementing the RoT must also be qualified for the expected mission radiation environment. Radiation tolerance addresses the reliability of the trust anchor, while immutability or protected update mechanisms address its resistance to unauthorized modification. This is particularly critical where radiation-induced bit flips and the physical inaccessibility of on-orbit hardware make a tamper-resistant, immutable hardware anchor essential to sustained boot integrity across the mission lifetime.