Unauthorized Modification of On-Orbit Update Binary

Detection of unauthorized modifications to an on-orbit update binary, indicated by mismatches in the SHA-256 hash value, potentially indicating that the binary has been replaced with a malicious version.

STIX Pattern

[file:hashes != 'expected_hash_value' AND file:name = 'on_orbit_update_binary']

SPARTA TTPs

ID Name Description
IA-0001.02 Software Supply Chain Threat actors may manipulate software binaries and applications prior to the customer receiving them in order to achieve data or system compromise. This attack can take place in a number of ways, including manipulation of source code, manipulation of the update and/or distribution mechanism, or replacing compiled versions with a malicious one.
IA-0007.01 Compromise On-Orbit Update Threat actors may manipulate and modify on-orbit updates before they are sent to the target spacecraft. This attack can be done in a number of ways, including manipulation of source code, manipulating environment variables, on-board table/memory values, or replacing compiled versions with a malicious one.