| CSNE-9 |
Unexpected Downlink Traffic Dropped or Disrupted |
Detection of downlink traffic being unexpectedly dropped or disrupted with a high error rate, potentially indicating an attack targeting the spacecraft's ability to send telemetry data. |
[network-traffic:direction = 'downlink' AND network-traffic:status = 'dropped' OR network-traffic:error_rate > 'acceptable_threshold'] |
| CSNE-40 |
Unplanned Deactivation of Downlink Transmitter |
Detection of the downlink transmitter being deactivated unexpectedly, potentially indicating a malicious action intended to disable the spacecraft's ability to send telemetry data to the ground. |
[x-opencti-telemetry:component = 'downlink_transmitter' AND x-opencti-telemetry:status = 'inactive' AND x-opencti-telemetry:deactivation_reason != 'planned'] |
| CSNE-41 |
High Latency Detected in Downlink Communication |
Detection of unusually high latency in downlink communications, which may indicate that an attacker is interfering with telemetry transmission to delay or disrupt communication between the spacecraft and ground controllers. |
[network-traffic:latency > 'acceptable_latency_threshold' AND network-traffic:direction = 'downlink'] |
| MIRE-6 |
Unexpected Modification of Memory Location Associated with Telemetry Data |
Detection of an unexpected modification in the memory block associated with telemetry data. The system identifies abnormal write operations in memory locations that store telemetry information before it is transmitted, suggesting manipulation by malware. Adversaries may change telemetry before downlink in order to prevent the ground from being aware of malware being on the spacecraft. |
[x-opencti-memory:block = 'telemetry_memory_block' AND x-opencti-memory:write_operation = 'unexpected' AND x-opencti-memory:modification_time != 'authorized_time'] |
| SIUU-25 |
Unauthorized Function Hooking in Telemetry Process |
Detection of unauthorized function hooking in the telemetry process, specifically targeting the packet_write_function. This hook allows the malware to modify telemetry data before it is transmitted to ground systems, concealing malicious activity onboard the spacecraft |
[process:image_ref.name = 'telemetry_process' AND process:hooked_function = 'packet_write_function'] |
| SIUU-26 |
Unauthorized Modification of Downlink Configuration |
Detection of unauthorized modifications to the downlink frequency configuration settings, suggesting a potential attack to disrupt the spacecraft's ability to transmit telemetry. |
[x-opencti-radio-configuration:downlink_frequency != 'authorized_value' AND x-opencti-radio-configuration:modification_time != 'scheduled_window'] |