Threat actors may compromise target owned ground systems that can be used for future campaigns or to perpetuate other techniques. These ground systems have already been configured for communications to the victim spacecraft. By compromising this infrastructure, threat actors can stage, launch, and execute an operation. Threat actors may utilize these systems for various tasks, including Execution and Exfiltration.
| ID | Name | Description | STIX Pattern |
| UACE-3 | Legitimate Command with Malicious Parameters Targeting Subsystems | A legitimate command is sent, but with parameters that exceed safe thresholds for a subsystem or component on the spacecraft. This could include commands that affect critical subsystems like power distribution, attitude control, or thermal regulation, potentially leading to damage, instability, or malfunction. The misuse of valid parameters across different subsystems can result in severe operational impact or hardware degradation. | [x-opencti-command-log:command_type = 'legitimate_command' AND x-opencti-command-log:target_subsystem != 'expected_subsystem' AND x-opencti-command-log:parameter_value > 'safe_threshold'] |
| UACE-4 | Unexpected Legitimate Command Sent | A legitimate command sent to the spacecraft at an unexpected or inappropriate time, potentially causing disruption to normal operations. This could potentially lead to impacting system availability. This could involve commands such as executing an orbit adjustment or resource-intensive task outside of planned windows, thereby affecting the mission's overall availability or operational efficiency. | [x-opencti-command-log:command_type = 'legitimate_command' AND x-opencti-command-log:timestamp != 'expected_time'] |
| UACE-24 | Unauthorized CLTU-START, STOP, or UNBIND Initiation from Unauthorized User or Rogue IP | Detects the initiation of the CLTU-START, CLTU-STOP, or CLTU-UNBIND commands by either an unauthorized user or a rogue IP address (even with valid credentials), potentially indicating malicious activity targeting session control. | [(x-opencti-command-log:command = 'CLTU-START' OR x-opencti-command-log:command = 'CLTU-STOP' OR x-opencti-command-log:command = 'CLTU-UNBIND') AND (x-opencti-command-log:user != 'authorized_user' OR network-traffic:src_ref.value != 'authorized_ip')] |
| UCEB-9 | Failed Credential Encryption in SLE Protocol | Detects that credentials in the CLTU-BIND message were transmitted without encryption, making them vulnerable to capture and replay attacks. The Space Link Extension (SLE) protocol itself does not provide built-in encryption for securing the data transmitted through its services. The protocol focuses on the extension of space link operations between ground systems, but it lacks native security features such as encryption. The SLE protocol was designed to facilitate operational efficiency rather than providing security mechanisms. Any security (including encryption) typically happens outside of the SLE protocol, through mechanisms such as bulk encryption at the hardware layer or via an external transport security layer (e.g., IPsec or TLS) added on top of the communication channels. Encryption is usually implemented at the hardware level (bulk encryption) or applied to the transport layer through external protocols. This ensures that the data exchanged between the SLE User (Mission Control System) and the SLE Provider (Ground Station) is protected during transmission. | [network-traffic:dst_ref.value = 'SLE_Provider' AND network-traffic:encryption_status != 'encrypted'] |
| UCEB-11 | Use of Account or Cryptographic Keys at Unexpected Times | Detection of a user account or cryptographic key being used outside of the expected operational time windows. This may indicate unauthorized or suspicious activity, such as a threat actor using valid credentials or cryptographic keys to gain or maintain persistent access to the spacecraft or related systems. | [user-account:last_login_time != 'expected_operational_hours' OR x-opencti-cryptographic-key:usage_time != 'expected_usage_time'] |
| CSNE-1 | Unexpected Ground Station IP Address in Communication | Detection of network traffic originating from an unauthorized IP address that does not match any of the known or authorized ground station IPs, potentially indicating communication with a rogue ground station. The source IPs that are permitted to speak to the spacecraft should be very limited. Rogue devices may get deployed internal to mission operations networks in an attempt to communicate to the spacecraft. | [network-traffic:src_ref.value != 'authorized_ground_station_ip' AND network-traffic:protocols[*] = 'satellite_communication'] |
| CSNE-2 | ARP Spoofing Attack (Rogue IP) | Rogue IP found communicating between the MOC and ground station which could indicate ARP Spoofing is occuring, or some other man-in-the-middle is going on. | [network-traffic:src_ref.role = 'ground_station' AND network-traffic:dst_ref.role = 'mission_control_system' AND network-traffic:src_ref.value != 'authorized_ip'] |
| CSNE-11 | Data Exfiltration Detected During Scheduled Communication Windows | Detection of larger-than-expected data packets sent during scheduled spacecraft communication windows, indicating that a compromised ground system may be exfiltrating data under the guise of legitimate operations. | [network-traffic:direction = 'downlink' AND network-traffic:data_size > 'expected_size'] |
| CSNE-21 | Unauthorized Data Transmission from Ground System to External IP | Detection of data transmissions originating from a compromised ground system to an external IP address not authorized for spacecraft operations, potentially indicating exfiltration of sensitive information. | [network-traffic:src_ref.role = 'ground_system' AND network-traffic:dst_ref.value != 'authorized_external_ip'] |
| CSNE-23 | Sudden Increase in Bandwidth Usage from Ground System | Detection of a sudden increase in network bandwidth usage from the ground system, which could indicate data exfiltration activities as threat actors attempt to move large amounts of information out of the compromised system. | [network-traffic:bandwidth_usage > 'expected_threshold' AND network-traffic:src_ref.role = 'ground_system'] |
| CSNE-24 | ARP Spoofing via MAC Address Mismatch | ARP spoofing detected by observing that the MAC address does not match the expected authorized MAC address for the ground station. | [network-traffic:src_ref.value != 'authorized_mac_address' AND network-traffic:src_ref.role = 'ground_station'] |
| ARFS-10 | CLTU BIND Authentication Failure | Detects a failure in authentication during the CLTU BIND process. This IOC detects any authentication failure during the CLTU BIND process. It captures a general case where the authentication does not succeed. | [x-opencti-command-log:command = 'CLTU-BIND' AND x-opencti-command-log:authentication_result = 'failure'] |
| DISE-13 | Flight Software Configuration Anomalies | Detection of anomalous or unauthorized configuration changes in flight software, potentially exploited by threat actors to enable malicious behavior or gain access to segmented subsystems. Much of the FSW functionality are driven by configuration files, tables, etc. For example, detection of an unexpected modification in the attitude control table, specifically related to momentum wheel control, indicating that a malicious update may have lowered the max momentum value to disable the wheel control. | [x-opencti-system:configuration = 'unexpected' AND x-opencti-system:subsystem = 'flight_software'] |