safemode.space
← All techniques
DE-0003
ST0006Defense Evasion

On-Board Values Obfuscation

Description

The adversary manipulates housekeeping and control values that operators and autonomy rely on to judge activity, health, and command hygiene. Targets include command/telemetry counters, event/severity flags, downlink/reporting modes, cryptographic-mode indicators, and the system clock. By rewriting, freezing, or biasing these fields, and by selecting reduced or summary telemetry modes, unauthorized actions can proceed while the downlinked picture appears routine or incomplete. The result is delayed recognition, misattribution to environmental effects, or logs that cannot be reconciled post-facto.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    direct

    On-board values obfuscation rewrites housekeeping and control values (counters, flags, modes, clock) — the manipulation of stored/processed data and configuration (2)(f) requires protection against and corruption-reporting on.

  • craAnnex I, Part I, (2)(l)
    addresses
    moderate
    direct

    The values being obfuscated (counters, flags, mode indicators) are the very recording fields (2)(l) requires the product to maintain for security-relevant internal activity monitoring.

  • eu-space-actArt. 83(1)
    addresses
    moderate
    direct

    The values being obfuscated ARE the recording fields 83(1)'s monitoring obligation depends on; tamper-resistance of telemetry is part of detection design.

  • eu-space-actArt. 84(2)
    addresses
    high
    direct

    On-board values obfuscation rewrites housekeeping, counters, and mode indicators — network-and-information-system data whose integrity 84(2)'s Annex VII point 5.1 must protect.

  • nis2Art. 21(2)(b)
    addresses
    high
    derived

    Bias of housekeeping counters, frozen severity flags, and reduced/summary telemetry modes that mask activity are the precise integrity failures Art. 21(2)(b)'s incident-handling capability must surface via cross-validation against orthogonal sources.

  • nis2Art. 21(2)(h)
    addresses
    moderate
    direct

    Signed and integrity-protected counter values, severity flags, and mode indicators under cryptography policy at Art. 21(2)(h) detect rewrites of the fields ground operators rely on for command-hygiene judgement.

  • nis2Art. 21(2)(i)
    addresses
    moderate
    direct

    Mode controls, counter registers, and reporting-configuration parameters are access-controlled assets; Art. 21(2)(i) governs which paths can manipulate the values operators rely on.

  • nis2-implAnnex 11.3.1
    addresses
    moderate
    derived

    Authority to write to housekeeping registers and obfuscate operator-visible state is privileged-account authority; the privileged-account policy is the lever that bounds the population that can issue these obfuscations.

  • nis2-implAnnex 3.2.1
    addresses
    high
    derived

    Monitoring-and-logging must surface counter freezes, mode-flag inconsistencies and crypto-state divergences across redundant telemetry paths, which are the observable signatures of on-board-value obfuscation.

  • nis2-implAnnex 6.4.1
    addresses
    moderate
    derived

    Housekeeping counters, severity flags, mode selectors and crypto-state indicators are change-managed values; documented change procedures detect unauthorized obfuscation of these operator-visible truths.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i01
    addresses
    high

    Configuration management of mode indicators, downlink modes, and crypto-mode selectors detects unauthorised obfuscation of on-board values.

  • ENISA-STL-2025-03-sD.25-i10
    addresses
    high

    Integrity checking covering proper management of information and records detects modification of housekeeping fields, counters, and mode indicators.

  • ENISA-STL-2025-03-sD.29-i05
    addresses
    moderate

    Mission cyber-actor-actions detection function surfaces deliberate biasing of telemetry to mask unauthorized activity.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, DE-0003 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.