Protocol Metadata Anomaly Detection

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1565.002 Transmitted Data Manipulation; SafeMode's curated mapping records DE-0009.04 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1565.002 Transmitted Data Manipulation; SafeMode's curated mapping records EX-0014 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1565.002 Transmitted Data Manipulation; SafeMode's curated mapping records EX-0014.01 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1565.002 Transmitted Data Manipulation; SafeMode's curated mapping records EX-0014.02 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1565.002 Transmitted Data Manipulation; SafeMode's curated mapping records EX-0014.03 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1011 Exfiltration Over Other Network Medium; SafeMode's curated mapping records EXF-0004 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1011 Exfiltration Over Other Network Medium; SafeMode's curated mapping records EXF-0006 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1011 Exfiltration Over Other Network Medium; SafeMode's curated mapping records EXF-0006.01 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1011 Exfiltration Over Other Network Medium; SafeMode's curated mapping records EXF-0006.02 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records EXF-0007 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1567 Exfiltration Over Web Service; SafeMode's curated mapping records EXF-0008 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1048 Exfiltration Over Alternative Protocol; SafeMode's curated mapping records EXF-0009 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1011 Exfiltration Over Other Network Medium; SafeMode's curated mapping records EXF-0010 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1199 Trusted Relationship; SafeMode's curated mapping records IA-0003 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1199 Trusted Relationship; SafeMode's curated mapping records IA-0006 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1190 Exploit Public-Facing Application; SafeMode's curated mapping records IA-0007 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1199 Trusted Relationship; SafeMode's curated mapping records IA-0013 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1041 Exfiltration Over C2 Channel; SafeMode's curated mapping records IMP-0006 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because IMP-0006 spans both a ground and a space face while the control reaches only one of them.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1210 Exploitation of Remote Services; SafeMode's curated mapping records LM-0001 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1210 Exploitation of Remote Services; SafeMode's curated mapping records LM-0002 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1021 Remote Services; SafeMode's curated mapping records LM-0003 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1021 Remote Services; SafeMode's curated mapping records LM-0004 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Protocol Metadata Anomaly Detection counters T1021 Remote Services; SafeMode's curated mapping records LM-0006 as addressing that same adversary behaviour in the space domain. Protocol metadata anomaly detection applies to the telecommand and telemetry link and to internal bus framing, both of which carry structured, baselineable metadata. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly, and because LM-0006 spans both a ground and a space face while the control reaches only one of them.