Payload Channel Operating Without Encryption

Monitors payload channels for unencrypted data exchanges that could indicate improper configuration or security degradation. Typically, the payload data is encrypted and an adversary may attempt to put payload into clear mode to further attacks.

STIX Pattern

[network-traffic:src_ref.value = 'payload_channel' AND network-traffic:encryption_status != 'encrypted']

SPARTA TTPs

ID Name Description
EXF-0010 Payload Communication Channel Threat actors can deploy malicious software on the payload(s) which can send data through the payload channel. Payloads often have their own communication channels outside of the main TT&C pathway which presents an opportunity for exfiltration of payload data or other spacecraft data depending on the interface and data exchange.