Unauthorized Signal Transmission to Secondary Receiver

Monitors for transmissions directed at the secondary receiver from sources not recognized as authorized ground stations, potentially indicating an attack attempt.

STIX Pattern

[network-traffic:dst_ref.channel = 'secondary_receiver' AND network-traffic:src_ref.value != 'authorized_ground_station']

SPARTA TTPs

ID Name Description
IA-0004 Secondary/Backup Communication Channel Threat actors may compromise alternative communication pathways which may not be as protected as the primary pathway. Depending on implementation the contingency communication pathways/solutions may lack the same level of security (i.e., physical security, encryption, authentication, etc.) which if forced to use could provide a threat actor an opportunity to launch attacks. Typically these would have to be coupled with other denial of service techniques on the primary pathway to force usage of secondary pathways.
IA-0004.02 Receiver Threat actors may target the backup/secondary receiver on the spacecraft as a method to inject malicious communications into the mission. The secondary receivers may come from different supply chains than the primary which could have different level of security and weaknesses. Similar to the ground station, the communication through the secondary receiver could be forced or happening naturally.