Local File Permissions

Derived by composition, not from a source that names this pair. D3FEND publishes that Local File Permissions counters T1565.001 Stored Data Manipulation; SafeMode's curated mapping records DE-0003.12 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because DE-0003.12 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Local File Permissions counters T1565.001 Stored Data Manipulation; SafeMode's curated mapping records DE-0009.05 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Local File Permissions counters T1565.001 Stored Data Manipulation; SafeMode's curated mapping records EX-0012.13 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because EX-0012.13 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Local File Permissions counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records EXF-0007 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Local File Permissions counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.