| MIRE-1 |
Anomalous Flash Write Operations Detected in Short Timeframe |
Detection of a high number of flash write operations in a short timeframe, indicating a coordinated effort to overwrite the spacecraft's flash memory entirely. This behavior is typical of wiper malware aiming to destroy all flash data. |
[x-opencti-memory:block = 'flash_memory' AND x-opencti-memory:write_operation_count > 'threshold' AND x-opencti-memory:write_duration < 'threshold'] |
| MIRE-2 |
Anomalous Flash/EEPROM Memory Checksums Detected |
Detection of a checksum mismatch for the flight software's flash / eeprom memory partitions. This could indicate that both the primary and redundant partitions have been corrupted by the malicious action, leading to a permanent denial of service (DoS). |
[x-opencti-memory:table_ref.name = 'flash_memory' OR x-opencti-memory:table_ref.name = 'eeprom_memory' AND x-opencti-memory:checksum != 'expected_checksum'] |
| MIRE-3 |
Unusual Access Frequency to Critical Memory Regions |
Monitors for excessive access to critical memory regions, which may indicate malicious activities. On a spacecraft, consistent and unexpected access (read or write) to critical memory regions could indicate malicious activities by malware. |
[x-opencti-memory:access_frequency > 'expected_rate' AND x-opencti-memory:memory_region != 'expected'] |
| MIRE-4 |
Skipped Boot Integrity Check |
Detects cases where boot / firmware integrity checks are bypassed, potentially due to a glitching or other attacks. |
[x-opencti-memory:block = 'boot' AND x-opencti-memory:integrity_check = 'skipped'] |
| MIRE-7 |
Unexpected Memory Value Write or Modification |
Detection of unexpected or unauthorized modifications to onboard memory values during the execution. This could be done during updates, configuration changes, or direct commanding. This attack could potentially leading to corruption of system values or triggering malicious behavior. An adversary may inject malicious information in the Flash or EEPROM or area where the FSW/Software is stored during an update. |
[x-opencti-memory:write_operation = 'unexpected_write' AND x-opencti-memory:value != 'expected'] |
| MIRE-9 |
Failed Boot Memory Validation |
Detection of boot memory validation failure, indicating that boot memory has been tampered with to bypass internal processes. This is similar to integrity failure detection but this is the overall boot process failing validation using whatever steps are established (i.e., digital signature, cryptography, etc.) |
[x-opencti-system:boot_memory_validation = 'failed'] |
| MIRE-10 |
Anomalous Boot Sequence Execution |
Detection of an unexpected boot sequence, indicating potential tampering or manipulation of boot memory during system startup. |
[x-opencti-system:boot_sequence = 'unexpected'] |
| MIRE-11 |
Detection of Malicious Code in Boot Memory (Integrity Failure) |
Detection of malicious code being executed or loaded into boot memory, indicated by a failed memory integrity check. |
[x-opencti-memory:block = 'boot' AND x-opencti-memory:integrity_check = 'failed'] |
| MIRE-16 |
Unexpected Boot Memory Modifications |
Detection of unexpected access and changes in the boot memory region, which may indicate an attempt to manipulate or modify the system's boot sequence. |
[x-opencti-memory:block = 'boot' AND x-opencti-memory-log:block = 'boot' AND x-opencti-memory-log:status != 'expected'] |
| MIRE-17 |
Unauthorized System Call to Open Flash Memory Blocks (/dev/mtd) |
Detection of unauthorized system calls to access flash memory devices or partitions (/dev/mtd%). These system calls indicate that a malicious script or process is attempting to modify or read flash memory, potentially targeting critical system areas like firmware or configuration data during an attack. |
[process:image_ref.name = 'open' AND file:path LIKE '/dev/mtd%' AND file:access_time != 'authorized_access_time'] |
| SIUU-8 |
Malicious Code via New Process |
Code execution detected from an unexpected source / process, possibly indicating unauthorized or malicious code running on the spacecraft. |
[x-opencti-logs:event_type = 'code_execution' AND x-opencti-processor-usage:activity_type = 'unexpected' AND x-opencti-processor-usage:process_name NOT IN ('list_of_known_processes')] |
| SIUU-9 |
Unexpected Software Crash Detected in Flight Software |
Detection of unexpected crashes in flight software, potentially caused by attempts to exploit software vulnerabilities or coding flaws that lead to system instability. Repeated or unexplained crashes may indicate ongoing exploitation attempts targeting the spacecraft's flight control systems. |
[x-opencti-software:status = 'crashed' AND x-opencti-software:component != 'expected_crash_behavior'] |