safemode.space
← All techniques
REC-0002.03
ST0001Reconnaissance
sub-technique

Operations

Parent: REC-0002

Description

Adversaries collect high-level operational descriptors to predict when the mission will be busy, distracted, or temporarily less instrumented. Useful items include CONOPS overviews, daily/weekly activity rhythms, ground pass schedules, DSN or commercial network windows, calibration and maintenance timelines, planned wheel unloads or thruster burns, conjunction-assessment cycles, and anomaly response playbooks at the level of “who acts when.” For constellations, they seek plane/slot assignments, phasing and drift strategies, crosslink usage, and failover rules between vehicles. These descriptors enable time-targeted campaigns, e.g., sending malicious but syntactically valid commands near handovers, exploiting reduced telemetry during safing, or saturating links during high-rate downlinks.

Mappings

EU regulation articles

  • eu-space-actArt. 80(3)
    addresses
    high
    direct

    CONOPS overviews, daily/weekly activity rhythms, ground pass schedules, and contingency playbooks are operator-controlled operational descriptors whose disclosure cascades into timing-attack capability — within 80(3)'s information categorization scope.

  • nis2-implAnnex 12.2.1
    addresses
    moderate
    derived

    Operational rhythms, eclipse seasons and maintenance windows are internal scheduling assets whose handling controls determine whether opex-style reconnaissance can profile entity activity.

ENISA controls

  • ENISA-STL-2025-03-sD.24-i01
    addresses
    low

    Information classification governs the protective marking of operational descriptors such as CONOPS and ground-pass schedules that REC-0002.03 gathers.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, REC-0002.03 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.