Threat actors may seek out valid credentials which can be utilized to maintain persistent access to the spacecraft or related C2 systems and facilitate additional tactics throughout an attack. Credentials may include, but are not limited to: system service accounts, user accounts, maintenance accounts, cryptographic keys and other authentication mechanisms.
| ID | Name | Description | STIX Pattern |
| UCEB-1 | Repeated Use of Cryptographic Keys from Unusual Locations | Detection of cryptographic keys being used repeatedly from unexpected or unauthorized locations, indicating potential misuse of valid cryptographic credentials to maintain persistent access to spacecraft systems. | [x-opencti-cryptographic-key:usage_location != 'authorized_locations' AND x-opencti-cryptographic-key:use_count > 'threshold'] |
| UCEB-2 | Use of Old or Rotated Cryptographic Keys for Authentication | Detection of authentication attempts using cryptographic keys that have already been rotated or marked as no longer valid. This may indicate that threat actors are using old or compromised keys to try to access to spacecraft or C2 systems. | [x-opencti-cryptographic-key:status = 'rotated or expired'] |
| UCEB-3 | Unexpected Access to Cryptographic Keys | Detection of unauthorized access to cryptographic keys used for decryption, suggesting that a threat actor may be attempting to disable or bypass the spacecraft's encryption mechanisms. | [x-opencti-cryptographic-key:access_time != 'authorized_access_time' AND x-opencti-cryptographic-key:usage = 'decryption'] |
| UCEB-4 | Unexpected Changes to Encryption Configuration Settings | Detection of unexpected changes to encryption settings, potentially indicating that the encryption mechanism on the spacecraft has been disabled or bypassed without authorization. | [x-opencti-encryption-config:status = 'disabled' AND x-opencti-encryption-config:change_time != 'authorized_change_time'] |
| UCEB-11 | Use of Account or Cryptographic Keys at Unexpected Times | Detection of a user account or cryptographic key being used outside of the expected operational time windows. This may indicate unauthorized or suspicious activity, such as a threat actor using valid credentials or cryptographic keys to gain or maintain persistent access to the spacecraft or related systems. | [user-account:last_login_time != 'expected_operational_hours' OR x-opencti-cryptographic-key:usage_time != 'expected_usage_time'] |
| MIRE-12 | Unexpected Modification to Encryption Memory/Table | Detection of an unauthorized modification to the encryption table, suggesting a potential malicious update affecting the telemetry, tracking, and control (TT&C) encryption settings. The change occurred in the memory range Value1 - Value999. The memory range will be different for each spacecraft. | [x-opencti-memory:table_ref.name = 'encryption_table' AND x-opencti-memory:checksum != 'expected_checksum' AND x-opencti-memory:range = 'Value1 - Value999'] |