Monitors for safe-mode exit commands executed at unexpected times, which could indicate an exploitation attempt by a threat actor leveraging timing to evade detection. Or threat actor could be exiting safe-mode to cause impact to the spacecraft prior to spacecraft being ready to exit safe-mode.
| ID | Name | Description | |
| EX-0011 | Exploit Reduced Protections During Safe-Mode | Threat actors who have access to a spacecraft in safe mode may issue malicious commands that would not normally be accepted during nominal operations. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. Because safe mode prioritizes essential functions and often disables non-critical protections or filters, adversaries can exploit this state to trigger unauthorized reconfiguration, software modification, or system manipulation during recovery or degraded operation. | |