Detection of several commands such as dd, grep, ps, awk, and chmod being executed, potentially indicating that the attacker is obfuscating their activity by manipulating process lists or file permissions to hide the rootkit or telemetry tampering. This system call in the context of a spacecraft running Linux is rarely used therefore any use is likely malicious. Many of these are being executed with root privileges, potentially indicating that the attacker is trying to perform destructive or obfuscation tasks with full system access.
| ID | Name | Description | |
| EX-0010 | Malicious Code | Threat actors may rely on other tactics and techniques in order to execute malicious code on the victim spacecraft. This can be done via compromising the supply chain or development environment in some capacity or taking advantage of known commands. However, once malicious code has been uploaded to the victim spacecraft, the threat actor can then trigger the code to run via a specific command or wait for a legitimate user to trigger it accidently. The code itself can do a number of different things to the hosted payload, subsystems, or underlying OS. | |
| EX-0010.03 | Rootkit | Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the flight software or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware. | |