Monitors for restricted commands or sequences being executed during safe-mode operations. Typically in safe-mode there is limited commands or sequences in which the spacecraft would expect to occur. Attackers may attempt to execute restricted commands or sequences while in safe-mode with the expectation that they work.
| ID | Name | Description | |
| EX-0011 | Exploit Reduced Protections During Safe-Mode | Threat actors may take advantage of the victim spacecraft being in safe mode and send malicious commands that may not otherwise be processed. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. During this mode, several commands are available to be processed that are not normally processed. Further, many protections may be disabled at this time. | |