safemode.space
← All techniques
DE-0003.05
ST0006Defense Evasion
sub-technique

Command Receiver Lock Modes

Parent: DE-0003

Description

Receivers advertise acquisition states, bit lock, frame lock, and command lock, that indicate readiness to accept telecommands. Adversaries leverage these indicators in two ways: (1) use command-lock tests to validate geometry, power, Doppler, and polarization without risking visible command execution; and (2) tamper with the values that report lock status so ground views never show that lock was achieved. Techniques include freezing or clearing lock flags and counters, raising/lowering internal thresholds so lock occurs without being reported (or vice versa), and timing brief lock intervals between telemetry samples. The result is a window where the spacecraft is receptive to commands while downlinked status suggests otherwise.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    direct

    Tampering with command-lock indicators and lock thresholds — freezing flags, raising/lowering internal thresholds — is unauthorized modification of stored data and configuration (2)(f) addresses.

  • craAnnex I, Part I, (2)(l)
    addresses
    moderate
    direct

    Lock-status indicators and counters are recording fields whose tampering defeats (2)(l)'s monitoring obligation.

  • eu-space-actArt. 84(2)
    addresses
    high
    direct

    Command-lock indicator tampering rewrites stored network-and-information-system status — 84(2)'s Annex VII point 5.1 integrity scope.

  • nis2Art. 21(2)(b)
    addresses
    moderate
    derived

    Lock-status indicators contradicted by command-acceptance behaviour, or by RF-link telemetry from the ground side, are detectable cross-source anomalies Art. 21(2)(b)'s incident-handling capability must surface.

  • nis2-implAnnex 3.2.1
    addresses
    high
    derived

    Monitoring-and-logging procedures must capture command-lock-state transitions, frame-lock anomalies and partial-acquisition telemetry, which are the observable signatures the adversary uses for geometry validation and quiet-window selection.

  • nis2-implAnnex 6.4.1
    addresses
    moderate
    derived

    Configuration changes that alter receiver lock-state reporting (telemetry packet contents, severity flags) are change-management events governed by documented procedures.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i01
    mitigates
    moderate

    Configuration management of receiver lock-mode settings detects unauthorised modifications that bias acquisition states.

  • ENISA-STL-2025-03-sD.29-i06
    addresses
    high

    Critical-telemetry-points monitoring of command-lock indicators flags abuse to validate geometry/credentials before final injection.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, DE-0003.05 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.