safemode.space
← All techniques
DE-0003.06
ST0006Defense Evasion
sub-technique

Telemetry Downlink Modes

Parent: DE-0003

Description

Spacecraft expose modes that control what telemetry is sent and how, real-time channels, recorder playback, beacon/summary only, event-driven reporting, and per-virtual-channel/APID selections. By switching modes or editing the associated parameters (rates, filters, playback queues, index ranges), an adversary can thin, defer, or reroute observability. Typical effects include suppressing high-rate engineering streams in favor of minimal beacons, delaying playback of time periods of interest, replaying benign segments, or redirecting packets to alternate virtual channels that are not routinely monitored. Telemetry continues to flow, but it no longer reflects the activity the operators need to see.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    direct

    Switching telemetry downlink modes and editing rates/filters/playback parameters is unauthorized modification of configuration parameters within (2)(f)'s scope.

  • craAnnex I, Part I, (2)(l)
    addresses
    high
    direct

    Telemetry modes ARE the configuration governing (2)(l)'s recording-and-monitoring channel; reducing it to beacons or replaying benign segments directly defeats the obligation.

  • eu-space-actArt. 83(1)
    addresses
    high
    direct

    Telemetry modes ARE the monitoring channel; 83(1)'s continuous monitoring depends on consistent, reliable telemetry mode/rate selection.

  • eu-space-actArt. 84(2)
    addresses
    high
    direct

    Telemetry mode/rate/filter configuration is network-and-information-system state under 84(2) — Annex VII point 5.1 includes integrity protection for monitoring-channel configuration.

  • nis2Art. 21(2)(b)
    addresses
    moderate
    derived

    Sudden shifts to beacon-only modes, deferred playback windows, or redirection of packets to rarely monitored VCIDs are detectable observability anomalies Art. 21(2)(b)'s incident-handling capability must surface.

  • nis2Art. 21(2)(i)
    addresses
    moderate
    direct

    Telemetry-mode controls, recorder-playback configuration, and per-VCID/APID selection parameters are access-controlled engineering configuration; Art. 21(2)(i) governs which roles can switch modes or thin observability.

  • nis2-implAnnex 3.2.1
    addresses
    moderate
    derived

    Monitoring-and-logging procedures should detect telemetry-mode transitions and per-VC/APID drop-outs that create selective evasion windows.

  • nis2-implAnnex 6.4.1
    addresses
    moderate
    derived

    Telemetry-mode switches, virtual-channel maps and APID selections are change-managed configuration; their modification follows documented procedures with review for mission-impact.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i01
    addresses
    high

    Telemetry downlink modes (real-time channels, recorder playback, beacon/summary, event-driven) are configuration items whose baseline must be monitored under configuration management.

  • ENISA-STL-2025-03-sD.29-i05
    addresses
    moderate

    Mission cyber-actor-actions detection surfaces telemetry-mode switches that throttle observability for evasion.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, DE-0003.06 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.