| UACE-3 |
Legitimate Command with Malicious Parameters Targeting Subsystems |
A legitimate command is sent, but with parameters that exceed safe thresholds for a subsystem or component on the spacecraft. This could include commands that affect critical subsystems like power distribution, attitude control, or thermal regulation, potentially leading to damage, instability, or malfunction. The misuse of valid parameters across different subsystems can result in severe operational impact or hardware degradation. |
[x-opencti-command-log:command_type = 'legitimate_command' AND x-opencti-command-log:target_subsystem != 'expected_subsystem' AND x-opencti-command-log:parameter_value > 'safe_threshold'] |
| UACE-24 |
Unauthorized CLTU-START, STOP, or UNBIND Initiation from Unauthorized User or Rogue IP |
Detects the initiation of the CLTU-START, CLTU-STOP, or CLTU-UNBIND commands by either an unauthorized user or a rogue IP address (even with valid credentials), potentially indicating malicious activity targeting session control. |
[(x-opencti-command-log:command = 'CLTU-START' OR x-opencti-command-log:command = 'CLTU-STOP' OR x-opencti-command-log:command = 'CLTU-UNBIND') AND (x-opencti-command-log:user != 'authorized_user' OR network-traffic:src_ref.value != 'authorized_ip')] |
| UACE-25 |
Telecommand Format Tampering in CLTU-TRANSFER_DATA |
Detects that the telecommand data within the CLTU-TRANSFER_DATA PDU does not conform to the expected CCSDS telecommand format, indicating tampering. |
[network-traffic:protocols = 'x_ccsds_tc' AND network-traffic:x_content_format != 'expected_ccsds_tc_format' AND network-traffic:x_content = 'cltu-transfer_data'] |
| UCEB-9 |
Failed Credential Encryption in SLE Protocol |
Detects that credentials in the CLTU-BIND message were transmitted without encryption, making them vulnerable to capture and replay attacks. The Space Link Extension (SLE) protocol itself does not provide built-in encryption for securing the data transmitted through its services. The protocol focuses on the extension of space link operations between ground systems, but it lacks native security features such as encryption. The SLE protocol was designed to facilitate operational efficiency rather than providing security mechanisms. Any security (including encryption) typically happens outside of the SLE protocol, through mechanisms such as bulk encryption at the hardware layer or via an external transport security layer (e.g., IPsec or TLS) added on top of the communication channels. Encryption is usually implemented at the hardware level (bulk encryption) or applied to the transport layer through external protocols. This ensures that the data exchanged between the SLE User (Mission Control System) and the SLE Provider (Ground Station) is protected during transmission. |
[network-traffic:dst_ref.value = 'SLE_Provider' AND network-traffic:encryption_status != 'encrypted'] |
| CSNE-1 |
Unexpected Ground Station IP Address in Communication |
Detection of network traffic originating from an unauthorized IP address that does not match any of the known or authorized ground station IPs, potentially indicating communication with a rogue ground station. The source IPs that are permitted to speak to the spacecraft should be very limited. Rogue devices may get deployed internal to mission operations networks in an attempt to communicate to the spacecraft. |
[network-traffic:src_ref.value != 'authorized_ground_station_ip' AND network-traffic:protocols[*] = 'satellite_communication'] |
| CSNE-2 |
ARP Spoofing Attack (Rogue IP) |
Rogue IP found communicating between the MOC and ground station which could indicate ARP Spoofing is occuring, or some other man-in-the-middle is going on. |
[network-traffic:src_ref.role = 'ground_station' AND network-traffic:dst_ref.role = 'mission_control_system' AND network-traffic:src_ref.value != 'authorized_ip'] |
| CSNE-3 |
Backup Channel Activity Outside Scheduled Time Windows |
Monitors for backup communication link activity at times that do not align with predefined operational schedules, signaling potential exploitation or unauthorized usage. |
[network-traffic:src_ref.value = 'backup_channel' AND network-traffic:timestamp != 'scheduled_window'] |
| CSNE-4 |
Unexpected Data Transfer Over Backup Channel While Primary Active |
Monitors traffic volume or bandwidth usage on the backup communication link to detect spikes that exceed normal operational thresholds, which may indicate malicious activity. Monitors backup communication channels for unexpected usage when the primary channel is functional, suggesting potential exploitation. |
[network-traffic:src_ref.value = 'backup_channel' AND network-traffic:traffic_volume > 'baseline_threshold' AND network-traffic:primary_channel_status = 'active'] |
| CSNE-5 |
Traffic Volume Spike on Backup Channel |
Monitors traffic volume or bandwidth usage on the backup communication link to detect spikes that exceed normal operational thresholds, which may indicate malicious activity. |
[network-traffic:src_ref.value = 'backup_channel' AND network-traffic:traffic_volume > 'baseline_threshold'] |
| CSNE-6 |
Unexpected Communication Protocols in Uplink |
Detection of unexpected communication protocols in the uplink traffic from a ground station or any rogue device (i.e., spacecraft), indicating that someone may be using non-standard protocols to communicate with the spacecraft. |
[network-traffic:protocols[*] != 'expected_protocol' AND network-traffic:direction = 'uplink'] |
| CSNE-7 |
Use of Unexpected Protocol on Backup Channel |
Monitors for protocol deviations on the backup channel, which could indicate exploitation attempts. |
[network-traffic:protocols != 'expected_protocol' AND network-traffic:src_ref.channel = 'backup_channel'] |
| CSNE-24 |
ARP Spoofing via MAC Address Mismatch |
ARP spoofing detected by observing that the MAC address does not match the expected authorized MAC address for the ground station. |
[network-traffic:src_ref.value != 'authorized_mac_address' AND network-traffic:src_ref.role = 'ground_station'] |
| ARFS-1 |
Authentication Process Tampering |
Detection of modifications to the authentication process, which may signal unauthorized changes by a threat actor seeking access to a spacecraft. Potential modifications include tampering with encryption keys or authentication tokens. Additionally, irregularities in sequence counters, such as receiving packets out of sequence, may indicate an adversary's attempt to align with the spacecraft's authentication or sequencing protocols. |
[x-opencti-system-log:authentication_process_modification = 'TRUE'] |
| ARFS-5 |
Failed Authentication Attempts Due to RF/EMI Interference |
Detection of failed authentication attempts on spacecraft systems potentially caused by RF or EMI interference. This indicator focuses on identifying anomalies in the RF communication environment, such as signal strength variations that do not correspond with legitimate communication patterns. Such anomalies may indicate an attempt to spoof communication signals or interfere with the authentication process to gain unauthorized access. Monitoring these failed attempts, especially when correlated with suspicious RF activity, helps in identifying and mitigating potential security threats. |
[x-opencti-radio-communication:signal_strength = 'unexpected_variation' AND x-opencti-authentication-log:status = 'failed' AND x-opencti-authentication-log:source_location NOT IN ('list_of_known_ground_stations')] |
| ARFS-10 |
CLTU BIND Authentication Failure |
Detects a failure in authentication during the CLTU BIND process. This IOC detects any authentication failure during the CLTU BIND process. It captures a general case where the authentication does not succeed. |
[x-opencti-command-log:command = 'CLTU-BIND' AND x-opencti-command-log:authentication_result = 'failure'] |
| ARFS-11 |
Authorized SLE Session Establishment by Attacker (Rogue IP) |
Detects an authorized SLE session established by the attacker using replayed / captured credentials, gaining control of the session. This is when attacker has valid credentials to establish the bind |
[x-opencti-command-log:command = 'CLTU-BIND' AND x-opencti-command-log:user = 'authorized_user' AND network-traffic:src_ref.value != 'authorized_ip'] |