Unauthorized Frequency Usage on Out-of-Band Link

Tracks unauthorized frequency usage on the out-of-band communication link.

STIX Pattern

[x-opencti-rf-sensor:frequency_band = 'out_of_band_channel' AND x-opencti-rf-sensor:usage != 'baseline_usage']

SPARTA TTPs

ID Name Description
EXF-0004 Out-of-Band Communications Link Threat actors may attempt to exfiltrate data via the out-of-band communication channels. While performing eavesdropping on the primary/second uplinks and downlinks is a method for exfiltration, some space vehicles leverage out-of-band communication links to perform actions on the space vehicle (i.e., re-keying). These out-of-band links would occur on completely different channels/frequencies and often operate on separate hardware on the space vehicle. Typically these out-of-band links have limited built-for-purpose functionality and likely do not present an initial access vector but they do provide ample exfiltration opportunity.