Payload Channel Activity Outside Scheduled Time Windows

Monitors for payload communication link activity at times that do not align with predefined operational schedules, signaling potential exploitation or unauthorized usage.

STIX Pattern

[network-traffic:src_ref.value = 'payload_channel' AND network-traffic:timestamp != 'scheduled_window']

SPARTA TTPs

ID Name Description
EXF-0010 Payload Communication Channel Threat actors can deploy malicious software on the payload(s) which can send data through the payload channel. Payloads often have their own communication channels outside of the main TT&C pathway which presents an opportunity for exfiltration of payload data or other spacecraft data depending on the interface and data exchange.