SPARTA Tactics (ST) represent the “why” of a SPARTA technique or sub-technique. It is the threat actor’s tactical goal and the reason they are performing a technique. For example, a threat actor may want to achieve initial access on a spacecraft via cyber means.
| ID | Name | Description | ||||||||||||
| ST0001 | Reconnaissance | Threat actor is trying to gather information they can use to plan future operations. | ||||||||||||
| ST0002 | Resource Development | Threat actor is trying to establish resources they can use to support operations. | ||||||||||||
| ST0003 | Initial Access | Threat actor is trying to get point of presence/command execution on the spacecraft or hosted payload. | ||||||||||||
| ST0004 | Execution | Threat actor is trying to execute malicious code on the spacecraft | ||||||||||||
| ST0005 | Persistence | Threat actor is trying to maintain their foothold/access to command/execute code on the spacecraft. | ||||||||||||
| ST0006 | Defense Evasion | Threat actor is trying to avoid being detected. | ||||||||||||
| ST0007 | Lateral Movement | Threat actor is trying to move through across sub-systems and/or payloads of the spacecraft. | ||||||||||||
| ST0008 | Exfiltration | Threat actor is trying to steal information. | ||||||||||||
| ST0009 | Impact | The Impact tactic captures adversary activity that directly produces or sustains an effect against the affected system. An impact may affect the spacecraft as a whole. It may instead affect a payload, subsystem, software service, communication path, mission function, or connected asset. Impact does not require permanent physical damage. Effects may be temporary or persistent. They may also be reversible, irreversible, destructive, or non-destructive. A spacecraft may remain powered and responsive while behaving in a way that benefits the adversary. It may mislead defenders, expose protected information, provide access to another system, or lose an essential mission function. Impact is not necessarily the final stage of an attack. Adversaries may revisit the Impact tactic several times during one operation. Impact activity may also create conditions for further reconnaissance, initial access, lateral movement, defense evasion, or other tactics. SPARTA does not imply a clean or linear attack chain. The revised Impact structure replaces broad outcome-based techniques with repeatable technical mechanisms. Terms such as denial, degradation, disruption, deception, and destruction describe possible effects or objectives. They do not explain how the adversary produced the effect. SPARTA characterizes Impact using two related concepts:
Impact Vectors do not assert that SPARTA knows the adversary’s actual intent. They describe conditional possibilities: if the adversary’s objective is a given vector, how could the selected Impact Technique support it? A single action may involve more than one Impact Technique. A technique may also support more than one Impact Vector. The technique should be selected based on the technical lever the adversary used. The vector should be selected based on the objective. Neither concept is mutually exclusive. Impact Technique pages also link to relevant SPARTA Techniques and Sub-Techniques from other tactics. Those mappings identify the technical behaviors that may enable or realize the mechanism. Users can follow the linked technique pages to their existing Countermeasures and Indicators of Behavior. Impact Vectors Impact Vectors describe why an adversary may produce an effect against a spacecraft or space-system element. The technique page provides one concise Illustrative Application for each applicable vector. These examples demonstrate the relationship between the mechanism and the conditional objective. They are not exhaustive results, canonical outcomes, or formal mappings to a specific spacecraft target. For example:
The following vectors may be associated with each Impact technique:
|