safemode.space
← All techniques
EX-0010
ST0004Execution

Malicious Code

Description

The adversary achieves on-board effects by introducing executable logic that runs on the vehicle, either native binaries and scripts, injected shellcode, or “data payloads” that an interpreter treats as code (e.g., procedure languages, table-driven automations). Delivery commonly piggybacks on legitimate pathways: software/firmware updates, file transfer services, table loaders, maintenance consoles, or command sequences that write to executable regions. Once staged, activation can be explicit (a specific command, mode change, or file open), environmental (time/geometry triggers), or accidental, where operator actions or routine autonomy invoke the implanted logic. Malicious code can target any layer it can reach: altering flight software behavior, manipulating payload controllers, patching boot or device firmware, or installing hooks in drivers and gateways that bridge bus and payload traffic. Effects range from subtle logic changes (quiet data tampering, command filtering) to overt actions (forced mode transitions, resource starvation), and may include secondary capabilities like covert communications, key material harvesting, or persistence across resets by rewriting images or configuration entries.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    derived

    Integrity protection on programs and configurations is the manufacturer-side obligation that resists introduction of executable logic via malicious code.

  • craAnnex I, Part I, (2)(k)
    addresses
    high
    derived

    Exploitation-mitigation mechanisms reduce the impact of successful malicious-code introduction by constraining what executable content can do at runtime.

  • craAnnex I, Part I, (2)(l)
    addresses
    moderate
    derived

    Logging and monitoring obligations require recording of relevant internal activity, including code-execution events that surface unauthorized executable logic.

  • craAnnex I, Part II, (3)
    addresses
    moderate
    direct

    Malicious-code-execution exploitation (primary mapping: Annex I, Part I, (2)(k)) cascades to (3)'s regular-tests obligation — exploitation-mitigation mechanisms must be validated through ongoing security testing.

  • eu-space-actArt. 78(1)
    addresses
    moderate
    direct

    Malicious-code execution requires vulnerable code paths or weak input validation — 78(1)(c)'s identify-vulnerabilities obligation extends to the application logic and interpreter pathways malicious code rides.

  • eu-space-actArt. 81(3)
    addresses
    moderate
    direct

    81(3)(b)'s restrict-access-to-critical-functions clause limits which entities can write to executable regions, load tables, or invoke maintenance consoles that deliver malicious code.

  • eu-space-actArt. 88(1)
    addresses
    moderate
    direct

    88(1)'s testing programme, including TLPT, validates that legitimate update/file-transfer/maintenance pathways do not accept malicious payloads.

  • eu-space-actArt. 88(3)
    addresses
    high
    direct

    Malicious-code testing (primary: Art. 88(1)) cascades to 88(3) — pre-launch and 3-yearly TLPT validates that update/file-transfer/maintenance pathways do not accept malicious payloads.

  • nis2Art. 21(2)(b)
    addresses
    moderate
    derived

    Implanted code activating under specific commands, modes, or environmental triggers is a paradigmatic incident; Art. 21(2)(b)'s incident-handling capability must surface activation events even when their triggers blend with routine autonomy.

  • nis2Art. 21(2)(e)
    addresses
    high
    direct

    Native binaries, scripts, shellcode, and 'data payloads' delivered via update paths, file-transfer services, table loaders, or maintenance consoles all ride the network-and-information-systems acquisition/development/maintenance pipeline Art. 21(2)(e) governs, including disclosed-vulnerability handling on the parsers and loaders involved.

  • nis2Art. 21(2)(h)
    addresses
    high
    inferred

    Signed binaries, table loads and firmware are cryptographic mechanisms that defeat malicious code accepted via the load path, but they do not reach runtime interpreter, shellcode and memory-write execution, where the operative control is execution control and memory protection. The CIR (EU) 2024/2690 Annex assigns that control to section 6 (6.9 protection against malicious and unauthorised software), not to the section 9 cryptography requirements. At NIS2 Art. 21(2)(h) the relationship is addresses.

  • nis2-implAnnex 6.2.1
    addresses
    moderate
    derived

    Code-signing and integrity-verification practices required by the secure-development life cycle constrain which executable artefacts the runtime accepts, narrowing the malicious-code-introduction surface.

  • nis2-implAnnex 6.6.1
    addresses
    moderate
    derived

    Security-patch-management procedures, by constraining how legitimate code is delivered, also serve as the procedural envelope that out-of-band malicious-code introduction must subvert.

  • nis2-implAnnex 6.9.1
    addresses
    high
    direct

    Introduction of executable logic (binaries, scripts, shellcode, interpreted data payloads) onto flight or ground systems is the canonical malicious-and-unauthorized-software threat the implementing regulation requires the entity to detect or prevent.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i03
    addresses
    moderate

    A secure development lifecycle governs secure engineering principles that reduce the writable-executable and table-driven seams EX-0010 abuses, relevant to the technique at the governance level rather than actively blocking injection at runtime.

  • ENISA-STL-2025-03-sD.25-i01
    addresses
    high

    Mission-system malicious-code protection at entry/exit and on system components is the canonical defense against the introduction of executable logic to the vehicle.

  • ENISA-STL-2025-03-sD.25-i10
    addresses
    high

    Integrity-checking mechanisms across mission software, programmable logic, and firmware detect injected binaries, hooks, and modified images.

  • ENISA-STL-2025-03-sD.29-i02
    addresses
    high

    On-board IDS/IPS with response/log capability and integration with fault management surfaces malicious-code execution and supports countermeasure selection.

Cross-reference controls

  • d3fendD3-AVEAsset Vulnerability Enumeration
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Asset Vulnerability Enumeration counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records EX-0010 as addressing that same adversary behaviour in the space domain. Enumerating known defects against the software actually flying is standard practice for flight COTS and FOSS components, not only ground assets. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-RSRestore Software
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Restore Software counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records EX-0010 as addressing that same adversary behaviour in the space domain. Reloading software to a host is the flight-software recovery upload as well as a ground reimage. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SCASystem Call Analysis
    addresses
    low

    Derived by composition, not from a source that names this pair. D3FEND publishes that System Call Analysis counters T1106 Native API; SafeMode's curated mapping records EX-0010 as addressing that same adversary behaviour in the space domain. System-call analysis applies wherever the flight executive mediates task requests for hardware and memory. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SCFSystem Call Filtering
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that System Call Filtering counters T1106 Native API; SafeMode's curated mapping records EX-0010 as addressing that same adversary behaviour in the space domain. Restricting which system services a task may invoke applies to a partitioned flight executive as well as a ground kernel. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SUSoftware Update
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Software Update counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records EX-0010 as addressing that same adversary behaviour in the space domain. Replacing old software is the patch uplink, which is how a known defect is closed on-orbit. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SWISoftware Inventory
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Software Inventory counters T1554 Compromise Host Software Binary; SafeMode's curated mapping records EX-0010 as addressing that same adversary behaviour in the space domain. A software inventory covers the flight build, its libraries, and their versions, which is the precondition for knowing what on-board defects exist. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • mitre-attack-enterpriseT1106Native API
    addresses
    moderate

    T1106 'Native API' is ATT&CK's execution-tactic technique for invoking native code/APIs to achieve adversary execution; SPARTA EX-0010 'Malicious Code' is the parent-level pattern for dropping and running attacker code on the spacecraft (typically via native FSW APIs or RTOS task creation). Tactic aligns.

  • mitre-attack-enterpriseT1204.002Malicious File
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1554Compromise Host Software Binary
    addresses
    moderate

    Malicious code on the spacecraft is typically embedded by modifying an existing FSW binary (insertion of malicious functions, relocation patches); T1554 'Compromise Host Software Binary' covers this binary-modification path. Cross-tactic moderate (T1554 is persistence) because the modification's effect is persistent execution.

  • mitre-attack-icsT0834Native API
    addresses
    moderate

    T0834 'Native API' is in MITRE ICS execution tactic and addresses adversary use of native OS/system APIs to execute code; SPARTA EX-0010 'Malicious Code' is the parent-level pattern for executing attacker code on the spacecraft, which typically uses native FSW/RTOS APIs. Tactic aligns (both execution); cross-domain moderate (RTOS-vs-enterprise-OS native-API gap).

  • nasa-bpgGR-MALW-01Malware Protection Function (Ground)
    mitigates
    moderate

    Malicious code protection at system entry and exit points and on system components is the ground-segment interdiction of malicious code, complementary to MI-MALW-01's on-board update-validation gate.

  • nasa-bpgMI-MALW-01Mission Malware Protection Function
    mitigates
    moderate

    Introducing executable logic that runs on the vehicle is interdicted at the update gate the practice mandates. Moderate rather than high because the technique also covers data payloads an interpreter treats as code, which update validation does not necessarily inspect.

  • nist-80053-rev5AC-14Permitted Actions Without Identification or Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3Access Enforcement
    addresses
    moderate

    AC-3 mitigates EX-0010 by enforcing approved authorizations on code-execution surfaces.

  • nist-80053-rev5AC-6Least Privilege
    addresses
    moderate

    AC-6 mitigates EX-0010 by minimizing privileges available to malicious code that does run.

  • nist-80053-rev5AU-14Session Audit
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-2Event Logging
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3Content of Audit Records
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3(1)Additional Audit Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4Audit Log Storage Capacity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4(1)Transfer to Alternate Storage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5Response to Audit Logging Process Failures
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(2)Real-time Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(5)Alternate Audit Logging Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(1)Automated Process Integration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(4)Central Review and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-8Time Stamps
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9Protection of Audit Information
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(2)Store on Separate Physical Systems or Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(3)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-3Information Exchange
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-7(6)Automation Support for Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8(1)Independent Penetration Testing Agent or Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-10Software Usage Restrictions
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-10(1)Open-source Software
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11User-installed Software
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11(3)Automated Enforcement and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-14Signed Components
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-2Baseline Configuration
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-4Impact Analyses
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-4(2)Verification of Controls
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-5(6)Limit Library Privileges
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7Least Functionality
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(4)Unauthorized Software — Deny-by-exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(5)Authorized Software — Allow-by-exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(8)Binary or Machine Executable Code
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-8System Component Inventory
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-8(7)Centralized Repository
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10System Recovery and Reconstitution
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10(4)Restore Within Time Period
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-12Safe Mode
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-2Contingency Plan
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-2(5)Continue Mission and Business Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-4(5)Self-challenge
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-2Identification and Authentication (Organizational Users)
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3Incident Response Testing
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(1)Automated Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(2)Coordination with Related Plans
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4Incident Handling
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(11)Integrated Incident Response Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(12)Malicious Code and Forensic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(14)Security Operations Center
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(3)Continuity of Operations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(5)Automatic Disabling of System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5Incident Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5(1)Automated Tracking, Data Collection, and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-10Emergency Shutoff
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-11Emergency Power
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-11(1)Alternate Power Supply — Minimal Operational Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-14Environmental Controls
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8Security and Privacy Architectures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(1)Defense in Depth
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PM-5System Inventory
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-10Threat Hunting
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3Risk Assessment
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(4)Predictive Cyber Analytics
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-5Vulnerability Monitoring and Scanning
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-5(11)Public Disclosure Program
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-5(3)Breadth and Depth of Coverage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-7Risk Response
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(1)Software and Firmware Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(2)Alternative Configuration Management Processes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(4)Trusted Generation
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11Developer Testing and Evaluation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(1)Static Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(2)Threat Modeling and Vulnerability Analyses
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(3)Independent Verification of Assessment Plans and Evidence
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(4)Manual Code Reviews
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(5)Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(6)Attack Surface Reviews
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(8)Dynamic Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(9)Interactive Application Security Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-15Development Process, Standards, and Tools
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-15(6)Continuous Improvement
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-15(7)Automated Vulnerability Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-15(8)Reuse of Threat and Vulnerability Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-2Allocation of Resources
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-3System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(5)System, Component, and Service Configurations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(9)Functions, Ports, Protocols, and Services in Use
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8Security and Privacy Engineering Principles
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(10)Hierarchical Trust
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(12)Hierarchical Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(13)Minimized Security Elements
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(19)Continuous Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(21)Self-analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(22)Accountability and Traceability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(23)Secure Defaults
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(24)Secure Failure and Recovery
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(25)Economic Security
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(26)Performance Security
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(29)Repeatable and Documented Procedures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(3)Modularity and Layering
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(30)Procedural Rigor
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(31)Secure System Modification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(4)Partially Ordered Dependencies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(7)Reduced Complexity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9External System Services
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(2)Anti-spoofing Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-2(2)Disassociability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-24Fail in Known State
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-32(1)Separate Physical Domains for Privileged Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5Denial-of-service Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5(3)Detection and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-51Hardware-based Protection
    relates to
    moderate

    Referenced in: sparta-data, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(10)Prevent Exfiltration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(29)Separate Subnets to Isolate Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(9)Restrict Threatening Outgoing Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(5)Restrict Inputs to Trusted Sources and Approved Formats
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(6)Injection Prevention
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-11Error Handling
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-13Predictable Failure Prevention
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-13(4)Standby Component Installation and Notification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-16Memory Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-17Fail-safe Procedures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3Malicious Code Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(10)Malicious Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(8)Detect Unauthorized Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4System Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(1)System-wide Intrusion Detection System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(10)Visibility of Encrypted Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(11)Analyze Communications Traffic Anomalies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(13)Analyze Traffic and Event Patterns
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(16)Correlate Monitoring Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(17)Integrated Situational Awareness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(2)Automated Tools and Mechanisms for Real-time Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(23)Host-based Devices
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(24)Indicators of Compromise
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(25)Optimize Network Traffic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(4)Inbound and Outbound Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(5)System-generated Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(7)Automated Response to Suspicious Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-6Security and Privacy Function Verification
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7Software, Firmware, and Information Integrity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(1)Integrity Checks
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(10)Protection of Boot Firmware
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(12)Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(15)Code Authentication
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(17)Runtime Application Self-protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(5)Automated Response to Integrity Violations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(6)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(8)Auditing Capability for Significant Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(9)Verify Boot Process
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SR-6(1)Testing and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • space-shieldT2010Modification of On Board Control Procedures modification
    addresses
    moderate

    T2010 'Modification of On Board Control Procedures' covers attackers modifying OBCPs to execute their own commands — addresses the 'data payloads that an interpreter treats as code' subset of EX-0010 (procedure languages, table-driven automations).

  • space-shieldT2014.003OBSW modification
    addresses
    high

    T2014.003 'OBSW modification' covers software-backdoor installation that 'permits future access' — directly aligned with EX-0010 Malicious Code's altering of flight software, manipulating payload controllers, and patching gateways.

SPARTA countermeasures

Cite as SafeMode Space, EX-0010 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.