Monitors for safe-mode exit commands executed at unexpected times, which could indicate an exploitation attempt by a threat actor leveraging timing to evade detection. Or threat actor could be exiting safe-mode to cause impact to the spacecraft prior to spacecraft being ready to exit safe-mode.
| ID | Name | Description | |
| EX-0011 | Exploit Reduced Protections During Safe-Mode | Threat actors may take advantage of the victim spacecraft being in safe mode and send malicious commands that may not otherwise be processed. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. During this mode, several commands are available to be processed that are not normally processed. Further, many protections may be disabled at this time. | |