Monitors for restricted commands or sequences being executed during safe-mode operations. Typically in safe-mode there is limited commands or sequences in which the spacecraft would expect to occur. Attackers may attempt to execute restricted commands or sequences while in safe-mode with the expectation that they work.
| ID | Name | Description | |
| EX-0011 | Exploit Reduced Protections During Safe-Mode | Threat actors who have access to a spacecraft in safe mode may issue malicious commands that would not normally be accepted during nominal operations. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. Because safe mode prioritizes essential functions and often disables non-critical protections or filters, adversaries can exploit this state to trigger unauthorized reconfiguration, software modification, or system manipulation during recovery or degraded operation. | |