Mission Adversarial Actions Detection Function

On-board values obfuscation defeats detection by falsifying the indicators an operator would read. An on-board adversary-action detection function that reasons across independent sources is what makes those falsifications visible, which is active detection against the technique's defining vector.

Altering the vehicle command counter hides that commands were accepted. On-board detection that cross-checks the counter against independent evidence of command execution defeats the concealment.

The rejected command counter is a detection indicator, and suppressing it conceals failed attempts. The same cross-checking argument applies.

Editing or pruning the accepted, rejected, and executed command histories removes the record an investigator would use. An on-board detection function raises the alert at the time of the action rather than depending on the log that the technique edits afterwards.

Masquerading as legitimate activity is what an on-board detector is meant to see through, but the practice states the requirement for a detection function without specifying the behavioural analysis that would separate the adversary from the operator.

A rootkit subverts the layer a detection function runs on, so an on-board detector is exactly what the technique targets. The practice is relevant but its effectiveness is contingent on the detector sitting below the compromised layer, which the excerpt does not require.

A bootkit executes before the detection function does, so the same contingency applies as for DE-0007 and more strongly.

Overflowing the audit log destroys evidence by volume. On-board detection that alerts on the overflow itself, rather than reading the log after the fact, is the direct answer.

Modification of on-board values is the class of action an on-board detector should surface. The practice governs the technique broadly; the parent spans thirteen distinct value classes and the excerpt commits to none of them.

Persistence across resets in boot paths and non-volatile images is detectable on-board in principle, but the practice does not reach the boot-time window where the technique establishes itself.

A software backdoor is a hidden command path that behaves normally until used. On-board detection of the use is plausible; detection of the dormant path is not, and the excerpt does not distinguish.