| CSNE-9 |
Unexpected Downlink Traffic Dropped or Disrupted |
Detection of downlink traffic being unexpectedly dropped or disrupted with a high error rate, potentially indicating an attack targeting the spacecraft's ability to send telemetry data. |
[network-traffic:direction = 'downlink' AND network-traffic:status = 'dropped' OR network-traffic:error_rate > 'acceptable_threshold'] |
| CSNE-40 |
Unplanned Deactivation of Downlink Transmitter |
Detection of the downlink transmitter being deactivated unexpectedly, potentially indicating a malicious action intended to disable the spacecraft�s ability to send telemetry data to the ground. |
[x-opencti-telemetry:component = 'downlink_transmitter' AND x-opencti-telemetry:status = 'inactive' AND x-opencti-telemetry:deactivation_reason != 'planned'] |
| CSNE-41 |
High Latency Detected in Downlink Communication |
Detection of unusually high latency in downlink communications, which may indicate that an attacker is interfering with telemetry transmission to delay or disrupt communication between the spacecraft and ground controllers. |
[network-traffic:latency > 'acceptable_latency_threshold' AND network-traffic:direction = 'downlink'] |
| CSNE-42 |
Multiple Failed Downlink Attempts from Spacecraft |
Detection of repeated failed attempts by the spacecraft to send telemetry data via the downlink, indicating potential disruption or interference preventing successful transmission. |
[x-opencti-telemetry-log:direction = 'downlink' AND x-opencti-telemetry-log:transmission_attempts > 'threshold' AND x-opencti-telemetry-log:status = 'failed'] |
| ARFS-3 |
Invalid RF Command Lock |
A signal source detected in the ocean between authorized ground stations resulted in a failure, leading to an 'invalid' classification. A signal is classified as 'valid' when the following conditions are met: the transponder operates at the correct frequency and power level, all signal characteristics align with expected parameters, and command lock is achieved, the signal originates from an authorized and expected location. |
[x-opencti-signal_char:value = 'invalid'] |
| ARFS-6 |
Abnormal Signal Strength |
Detection of abnormal or excessive signal strength in communications, which could indicate the presence of a rogue device attempting to overpower legitimate signals and gain control of the spacecraft. |
[network-traffic:signal_strength > 'expected_threshold' AND network-traffic:protocols[*] = 'satellite_communication'] |
| MIRE-6 |
Unexpected Modification of Memory Location Associated with Telemetry Data |
Detection of an unexpected modification in the memory block associated with telemetry data. The system identifies abnormal write operations in memory locations that store telemetry information before it is transmitted, suggesting manipulation by malware. Adversaries may change telemetry before downlink in order to prevent the ground from being aware of malware being on the spacecraft. |
[x-opencti-memory:block = 'telemetry_memory_block' AND x-opencti-memory:write_operation = 'unexpected' AND x-opencti-memory:modification_time != 'authorized_time'] |
| SIUU-25 |
Unauthorized Function Hooking in Telemetry Process |
Detection of unauthorized function hooking in the telemetry process, specifically targeting the packet_write_function. This hook allows the malware to modify telemetry data before it is transmitted to ground systems, concealing malicious activity onboard the spacecraft |
[process:image_ref.name = 'telemetry_process' AND process:hooked_function = 'packet_write_function'] |
| SIUU-26 |
Unauthorized Modification of Downlink Configuration |
Detection of unauthorized modifications to the downlink frequency configuration settings, suggesting a potential attack to disrupt the spacecraft�s ability to transmit telemetry. |
[x-opencti-radio-configuration:downlink_frequency != 'authorized_value' AND x-opencti-radio-configuration:modification_time != 'scheduled_window'] |
| SMSR-17 |
Telemetry Packet Drops Due to CPU or Memory Overload |
Detection of a high rate of dropped telemetry packets coinciding with CPU or memory exhaustion, indicating that a malicious process is consuming system resources and preventing critical flight software operations. |
[x-opencti-telemetry:packet_drop_rate > 'threshold' AND x-opencti-system:cpu_usage > 'threshold'] |