Threat actors may compromise development environments located within the ground system or a developer/partner site. This attack can take place in a number of different ways, including manipulation of source code, manipulating environment variables, or replacing compiled versions with a malicious one. This technique is usually performed before the target spacecraft is in orbit, with the hopes of adding malicious code to the actual FSW during the development process.
| ID | Name | Description | STIX Pattern |
| CSNE-11 | Data Exfiltration Detected During Scheduled Communication Windows | Detection of larger-than-expected data packets sent during scheduled spacecraft communication windows, indicating that a compromised ground system may be exfiltrating data under the guise of legitimate operations. | [network-traffic:direction = 'downlink' AND network-traffic:data_size > 'expected_size'] |
| CSNE-21 | Unauthorized Data Transmission from Ground System to External IP | Detection of data transmissions originating from a compromised ground system to an external IP address not authorized for spacecraft operations, potentially indicating exfiltration of sensitive information. | [network-traffic:src_ref.role = 'ground_system' AND network-traffic:dst_ref.value != 'authorized_external_ip'] |
| CSNE-23 | Sudden Increase in Bandwidth Usage from Ground System | Detection of a sudden increase in network bandwidth usage from the ground system, which could indicate data exfiltration activities as threat actors attempt to move large amounts of information out of the compromised system. | [network-traffic:bandwidth_usage > 'expected_threshold' AND network-traffic:src_ref.role = 'ground_system'] |
| SIUU-4 | Abnormal Software Update Activity Detected | Detection of unauthorized or abnormal software update attempts, particularly affecting critical spacecraft subsystems or even FSW as a whole. This may be an indicator of an attacker exploiting a code flaw to introduce malicious code or manipulate software functionality. | [x-opencti-update-log:source != 'trusted_source' AND x-opencti-update-log:software_component = 'critical_subsystem'] |
| SIUU-18 | Suspicious Activity in Software Compilation or Build Process | Detection of suspicious activities or errors in the spacecraft software compilation process, potentially indicating tampering with source code or injecting malicious components into the compiled software before it is delivered to the spacecraft. | [x-opencti-build-log:process = 'compilation' AND x-opencti-build-log:result != 'expected'] |
| SIUU-19 | Unauthorized Modification of Source Code in Software Repository | Detection of unauthorized modifications to source code in a software repository used to develop or update spacecraft software, indicating potential code injection or manipulation in the supply chain to introduce malicious functionality. | [x-opencti-code-repository:commit_author != 'trusted_contributor' AND x-opencti-code-repository:code_change != 'expected'] |