Monitors the status of critical security features (e.g., COMSEC) to detect if they are disabled during safe-mode operations. The security feature would need to be determined by engineer, but COMSEC is an example. An example of how to build pattern for COMSEC, [x-opencti-security-feature:feature = 'encryption' AND x-opencti-security-feature:status = 'disabled' AND x-opencti-spacecraft-status:mode = 'safe-mode']
| ID | Name | Description | |
| EX-0011 | Exploit Reduced Protections During Safe-Mode | Threat actors may take advantage of the victim spacecraft being in safe mode and send malicious commands that may not otherwise be processed. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. During this mode, several commands are available to be processed that are not normally processed. Further, many protections may be disabled at this time. | |