Threat actors may compromise access to partner sites that can be used for future campaigns or to perpetuate other techniques. These sites are typically configured for communications to the primary ground station(s) or in some cases the spacecraft itself. Unlike mission operated ground systems, partner sites may provide an easier target for threat actors depending on the company, roles and responsibilities, and interests of the third-party. By compromising this infrastructure, threat actors can stage, launch, and execute an operation. Threat actors may utilize these systems for various tasks, including Execution and Exfiltration.
| Priority 1 | Priority 2 | Priority 3 | Priority 4 |
| CWE-345: Insufficient Verification of Data Authenticity | CWE-669: Incorrect Resource Transfer Between Spheres |
| ID | Name | Description | STIX Pattern |
| CSNE-11 | Data Exfiltration Detected During Scheduled Communication Windows | Detection of larger-than-expected data packets sent during scheduled spacecraft communication windows, indicating that a compromised ground system may be exfiltrating data under the guise of legitimate operations. | [network-traffic:direction = 'downlink' AND network-traffic:data_size > 'expected_size'] |
| CSNE-21 | Unauthorized Data Transmission from Ground System to External IP | Detection of data transmissions originating from a compromised ground system to an external IP address not authorized for spacecraft operations, potentially indicating exfiltration of sensitive information. | [network-traffic:src_ref.role = 'ground_system' AND network-traffic:dst_ref.value != 'authorized_external_ip'] |
| CSNE-23 | Sudden Increase in Bandwidth Usage from Ground System | Detection of a sudden increase in network bandwidth usage from the ground system, which could indicate data exfiltration activities as threat actors attempt to move large amounts of information out of the compromised system. | [network-traffic:bandwidth_usage > 'expected_threshold' AND network-traffic:src_ref.role = 'ground_system'] |