Monitors traffic volume or bandwidth usage on the payload communication link to detect spikes that exceed normal operational thresholds, which may indicate malicious activity.
| ID | Name | Description | |
| EXF-0010 | Payload Communication Channel | Threat actors can deploy malicious software on the payload(s) which can send data through the payload channel. Payloads often have their own communication channels outside of the main TT&C pathway which presents an opportunity for exfiltration of payload data or other spacecraft data depending on the interface and data exchange. | |