Threat actors may use the hosted payload within the victim spacecraft in order to gain access to other subsystems. The hosted payload often has a need to gather and send data to the internal subsystems, depending on its purpose. Threat actors may be able to take advantage of this communication in order to laterally move to the other subsystems and have commands be processed.
| ID | Name | Description | STIX Pattern |
| CSNE-14 | Unusual Data Transmission Between SpaceWire Routing Switches | Detection of unusual data transmissions from a SpaceWire routing switch to critical subsystems, potentially indicating the exploitation of a flat architecture to inject crafted data into sensitive areas of the spacecraft. | [x-opencti-bus-traffic:src_ref.role = 'routing_switch' AND x-opencti-bus-traffic:dst_ref.role = 'critical_subsystem'] |
| CSNE-15 | Unexpected Communication Between Subsystems | Detection of unexpected communication between spacecraft subsystems that should not normally interact directly on the same bus, potentially indicating lateral movement by a threat actor across a flat architecture. For example, a subsystem could attempt to modify the watchdog timer or other onboard values. | [x-opencti-bus-traffic:src_ref.subsystem != 'expected_subsystem' AND x-opencti-bus-traffic:dst_ref.subsystem != 'authorized_subsystem'] |
| CSNE-19 | Unexpected High-Priority Messages on the CAN Bus | Detection of unexpected high-priority CAN messages (lower message IDs) originating from unauthorized subsystems. This may indicate that a threat actor is injecting high-priority messages to dominate the CAN bus and manipulate subsystem communications. | [x-opencti-bus-traffic:can_message_id < 'expected_lowest_priority' AND x-opencti-bus-traffic:src_ref.subsystem != 'authorized_subsystem'] |
| CSNE-25 | CAN Bus Error Frames Detected Across Multiple Nodes | Detection of a high number of CAN error frames from multiple nodes, indicating that an attacker might be deliberately causing errors to disrupt communication on the bus or cause certain subsystems to enter error-passive or bus-off states. | [x-opencti-can-error-frame:error_count > 'threshold' AND bus-traffic:src_ref.subsystem != 'authorized_subsystem'] |
| CSNE-26 | Frequent CAN Arbitration Loss by Critical Subsystems | Detection of critical subsystems repeatedly losing CAN arbitration, which may indicate that an attacker is exploiting CAN�s arbitration mechanism by sending high-priority (low-ID) messages to suppress critical subsystem communication. | [x-opencti-can-arbitration:loss_count > 'threshold' AND x-opencti-can-arbitration:losing_node = 'critical_subsystem'] |
| CSNE-27 | Unexpected Communication Between SpaceWire Nodes | Detection of unexpected communication between SpaceWire nodes that are not supposed to interact, potentially indicating lateral movement across the spacecraft's flat bus architecture. | [x-opencti-bus-traffic:src_ref.spacewire_node != 'expected_node' AND x-opencti-bus-traffic:dst_ref.spacewire_node != 'authorized_node'] |
| CSNE-30 | Unauthorized Device Acting as Bus Controller (1553) | Detection of an unauthorized device acting as the bus controller, potentially indicating privilege escalation by a threat actor aiming to control the spacecraft�s communication bus. | [x-opencti-bus-controller:role = 'bus_controller' AND x-opencti-bus-controller:device != 'authorized_bus_controller'] |
| CSNE-31 | Specially Crafted CAN Messages Sent to Critical Subsystems | Detection of specially crafted CAN messages targeting critical subsystems with unexpected message IDs or payloads, suggesting an attacker is trying to inject malicious commands to compromise key systems. | [x-opencti-bus-traffic:can_message_id = 'unexpected_value' AND x-opencti-bus-traffic:dst_ref.role = 'critical_subsystem'] |
| CSNE-32 | Repeated CAN Message Spoofing Detected Between Subsystems | Detection of CAN messages with legitimate message IDs but originating from unauthorized subsystems, indicating that an attacker is spoofing CAN messages to imitate legitimate subsystems and move laterally across the spacecraft. | [x-opencti-bus-traffic:x_can_message_id = 'legitimate_id' AND x-opencti-bus-traffic:src_ref.subsystem != 'authorized_subsystem'] |
| CSNE-33 | Unusual Communication Between Payload and Critical Subsystems | Detection of unusual communication between a payload and critical subsystems , indicating that the flat bus architecture may be exploited to allow a payload to interact with sensitive parts of the spacecraft. | [x-opencti-bus-traffic:src_ref.role = 'payload' AND x-opencti-bus-traffic:dst_ref.role = 'critical_subsystem'] |