| UACE-3 |
Legitimate Command with Malicious Parameters Targeting Subsystems |
A legitimate command is sent, but with parameters that exceed safe thresholds for a subsystem or component on the spacecraft. This could include commands that affect critical subsystems like power distribution, attitude control, or thermal regulation, potentially leading to damage, instability, or malfunction. The misuse of valid parameters across different subsystems can result in severe operational impact or hardware degradation. |
[x-opencti-command-log:command_type = 'legitimate_command' AND x-opencti-command-log:target_subsystem != 'expected_subsystem' AND x-opencti-command-log:parameter_value > 'safe_threshold'] |
| UCEB-1 |
Repeated Use of Cryptographic Keys from Unusual Locations |
Detection of cryptographic keys being used repeatedly from unexpected or unauthorized locations, indicating potential misuse of valid cryptographic credentials to maintain persistent access to spacecraft systems. |
[x-opencti-cryptographic-key:usage_location != 'authorized_locations' AND x-opencti-cryptographic-key:use_count > 'threshold'] |
| UCEB-11 |
Use of Account or Cryptographic Keys at Unexpected Times |
Detection of a user account or cryptographic key being used outside of the expected operational time windows. This may indicate unauthorized or suspicious activity, such as a threat actor using valid credentials or cryptographic keys to gain or maintain persistent access to the spacecraft or related systems. |
[user-account:last_login_time != 'expected_operational_hours' OR x-opencti-cryptographic-key:usage_time != 'expected_usage_time'] |
| CSNE-3 |
Backup Channel Activity Outside Scheduled Time Windows |
Monitors for backup communication link activity at times that do not align with predefined operational schedules, signaling potential exploitation or unauthorized usage. |
[network-traffic:src_ref.value = 'backup_channel' AND network-traffic:timestamp != 'scheduled_window'] |
| CSNE-4 |
Unexpected Data Transfer Over Backup Channel While Primary Active |
Monitors traffic volume or bandwidth usage on the backup communication link to detect spikes that exceed normal operational thresholds, which may indicate malicious activity. Monitors backup communication channels for unexpected usage when the primary channel is functional, suggesting potential exploitation. |
[network-traffic:src_ref.value = 'backup_channel' AND network-traffic:traffic_volume > 'baseline_threshold' AND network-traffic:primary_channel_status = 'active'] |
| CSNE-5 |
Traffic Volume Spike on Backup Channel |
Monitors traffic volume or bandwidth usage on the backup communication link to detect spikes that exceed normal operational thresholds, which may indicate malicious activity. |
[network-traffic:src_ref.value = 'backup_channel' AND network-traffic:traffic_volume > 'baseline_threshold'] |
| CSNE-23 |
Sudden Increase in Bandwidth Usage from Ground System |
Detection of a sudden increase in network bandwidth usage from the ground system, which could indicate data exfiltration activities as threat actors attempt to move large amounts of information out of the compromised system. |
[network-traffic:bandwidth_usage > 'expected_threshold' AND network-traffic:src_ref.role = 'ground_system'] |