Malicious Code and Forensic Analysis

Parent: IR-4

Description

Analyze malicious code and/or other residual artifacts remaining in the system after the incident.

Mapped SPARTA techniques

151 techniques

DE-0001 Disable Fault ManagementST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002 Disrupt or Deceive DownlinkST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002.01 Inhibit Ground System FunctionalityST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002.03 Inhibit Spacecraft FunctionalityST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003 On-Board Values ObfuscationST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.01 Vehicle Command Counter (VCC)ST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.02 Rejected Command CounterST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.03 Command Receiver On/Off ModeST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.04 Command Receivers Received Signal StrengthST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.05 Command Receiver Lock ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.06 Telemetry Downlink ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.07 Cryptographic ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.08 Received CommandsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.09 System Clock for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.10 GPS EphemerisST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.11 Watchdog Timer (WDT) for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.12 Poison AI/ML Training for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0004 MasqueradingST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0005 Subvert Protections via Safe-ModeST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0006 Modify WhitelistST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0007 Evasion via RootkitST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0008 Evasion via BootkitST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0009.04 Targeted Deception of Onboard SSA/SDA SensorsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0009.05 Corruption or Overload of Ground-Based SDA SystemsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0010 Overflow Audit LogST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0011 Credentialed EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0001 ReplayST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0001.01 Command PacketsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0001.02 Bus Traffic ReplayST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0002 Position, Navigation, and Timing (PNT) GeofencingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0003 Modify Authentication ProcessST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0005 Exploit Hardware/Firmware CorruptionST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0005.01 Design FlawsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0005.02 Malicious Use of Hardware CommandsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0006 Disable/Bypass EncryptionST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0007 Trigger Single Event UpsetST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0008 Time Synchronized ExecutionST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0008.01 Absolute Time SequencesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0008.02 Relative Time SequencesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009 Exploit Code FlawsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009.01 Flight SoftwareST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009.02 Operating SystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0009.03 Known Vulnerability (COTS/FOSS)ST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010 Malicious CodeST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.01 RansomwareST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.02 Wiper MalwareST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.03 RootkitST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0010.04 BootkitST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0011 Exploit Reduced Protections During Safe-ModeST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012 Modify On-Board ValuesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.01 RegistersST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.02 Internal Routing TablesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.03 Memory Write/LoadsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.04 App/Subscriber TablesST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.05 Scheduling AlgorithmST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.06 Science/Payload DataST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.07 Propulsion SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.08 Attitude Determination & Control SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.09 Electrical Power SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.10 Command & Data Handling SubsystemST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.11 Watchdog Timer (WDT)ST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.12 System ClockST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0012.13 Poison AI/ML Training DataST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0013 FloodingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0013.01 Valid CommandsST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0013.02 Erroneous InputST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014 SpoofingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.01 Time SpoofST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.02 Bus Traffic SpoofingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.03 Sensor DataST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0014.04 Position, Navigation, and Timing (PNT) SpoofingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0015 Side-Channel AttackST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0016.03 Position, Navigation, and Timing (PNT) JammingST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0001 ReplayST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0006 Modify Communications ConfigurationST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0006.01 Software Defined RadioST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0006.02 TransponderST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0007 Compromised Ground SystemST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0008 Compromised Developer SiteST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EXF-0009 Compromised Partner SiteST0008
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0002 Compromise Software Defined RadioST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0003 Crosslink via Compromised NeighborST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0004 Secondary/Backup Communication ChannelST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0004.01 Ground StationST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0005.02 Docked Vehicle / OSAMST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0006 Compromise Hosted PayloadST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0007 Compromise Ground SystemST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0007.01 Compromise On-Orbit UpdateST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0007.02 Malicious Commanding via Valid GSST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0008 Rogue External EntityST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0008.01 Rogue Ground StationST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0008.02 Rogue SpacecraftST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009 Trusted RelationshipST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009.01 Mission Collaborator (academia, international, etc.)ST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009.02 VendorST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0009.03 User SegmentST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0010 Unauthorized Access During Safe-ModeST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0011 Auxiliary Device CompromiseST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0012 Assembly, Test, and Launch Operation CompromiseST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
IA-0013 Compromise Host SpacecraftST0003
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0001 Hosted PayloadST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0002 Exploit Lack of Bus SegregationST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0003 Constellation Hopping via CrosslinkST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0004 Visiting Vehicle Interface(s)ST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
LM-0007 Credentialed TraversalST0007
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0001 Memory CompromiseST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0002 BackdoorST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0002.01 Hardware BackdoorST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0002.02 Software BackdoorST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0003 Ground System PresenceST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0004 Replace Cryptographic KeysST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
PER-0005 Credentialed PersistenceST0005
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0002 Compromise InfrastructureST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0002.01 Mission-Operated Ground SystemST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0002.02 3rd Party Ground SystemST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0003 Obtain Cyber CapabilitiesST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0003.02 Cryptographic KeysST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0004 Stage CapabilitiesST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0004.01 Identify/Select Delivery MechanismST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
RD-0004.02 Upload Exploit/PayloadST0002
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001 Gather Spacecraft Design InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.01 Software DesignST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.02 FirmwareST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.03 Cryptographic AlgorithmsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.04 Data BusST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.05 Thermal Control SystemST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.06 Maneuver & ControlST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.07 PayloadST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.08 PowerST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0001.09 Fault ManagementST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002 Gather Spacecraft DescriptorsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002.01 IdentifiersST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002.02 OrganizationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0002.03 OperationsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003 Gather Spacecraft Communications InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.01 Communications EquipmentST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.02 Commanding DetailsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.03 Mission-Specific Channel ScanningST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0003.04 Valid CredentialsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0004 Gather Launch InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0004.01 Flight TerminationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0006 Gather FSW Development InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0006.01 Development EnvironmentST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0006.02 Security Testing ToolsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0007 Monitor for Safe-Mode IndicatorsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008 Gather Supply Chain InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.01 Hardware ReconST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.02 Software ReconST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.03 Known VulnerabilitiesST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0008.04 Business RelationshipsST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
REC-0009 Gather Mission InformationST0001
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.

Cite as SafeMode Space, nist-80053-rev5 IR-4(12).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description

›Mapped SPARTA techniques

151 techniques

Description

Mapped SPARTA techniques