safemode.space
← All techniques
EX-0008.02
ST0004Execution
sub-technique

Relative Time Sequences

Parent: EX-0008

Description

Execution is keyed to elapsed time since a reference event. The implant latches a start point, boot, reset, safing entry/exit, receipt of a particular telemetry/command pattern, achievement of sun-pointing, and arms a countdown or set of offsets (“N seconds after event,” “repeat every M cycles”). Relative sequences are resilient to clock discontinuities and mirror how many spacecraft schedule internal activities (e.g., after boot, run calibrations; after acquisition, start downlink). An attacker exploits this to ensure the trigger fires only within specific operational phases and to survive resets that would thwart absolute timestamps: after every reboot, wait for housekeeping steady state, then act; or, after a wheel unload completes, inject an additional command while control laws are in a known configuration.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(l)
    addresses
    moderate
    derived

    Logging/monitoring obligation captures relative-time activations correlated with reset, safing or pattern-event references the trigger latches to.

  • craAnnex I, Part II, (3)
    addresses
    moderate
    derived

    Effective security testing surfaces relative-time-keyed triggers that activate after specific event sequences.

  • nis2-implAnnex 3.2.1
    addresses
    moderate
    derived

    Monitoring should correlate anomalous behaviour with prior reset/safing/comm-pattern events that match relative-time-trigger latch points.

  • nis2-implAnnex 6.9.1
    addresses
    moderate
    derived

    Code that latches to elapsed-time or event-relative triggers is unauthorized software; the malware-protection obligations cover this dormant-trigger class.

ENISA controls

  • ENISA-STL-2025-03-sD.33-i02
    mitigates
    moderate

    End-to-end abuse-case testing including reboot, safing entry, and acquisition events catches event-pattern-keyed implants.

  • ENISA-STL-2025-03-sD.33-i05
    addresses
    high

    Long-duration testing including across reset/safing cycles surfaces relative-time-keyed implants that latch on event-pattern triggers.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, EX-0008.02 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.