Communication to Unauthorized Neighboring Spacecraft

Monitors for crosslink communications targeting spacecraft not included in the authorized constellation network. Your spacecraft could be used as a pivot point to other spacecraft.

STIX Pattern

[network-traffic:src_ref.value = 'crosslink' AND network-traffic:dst_ref.value != 'authorized_spacecraft']

SPARTA TTPs

ID Name Description
IA-0003 Crosslink via Compromised Neighbor Threat actors may compromise a victim spacecraft via the crosslink communications of a neighboring spacecraft that has been compromised. spacecraft in close proximity are able to send commands back and forth. Threat actors may be able to leverage this access to compromise other spacecraft once they have access to another that is nearby.
LM-0003 Constellation Hopping via Crosslink Threat actors may attempt to command another neighboring spacecraft via crosslink. spacecraft in close proximity are often able to send commands back and forth. Threat actors may be able to leverage this access to compromise another spacecraft.