Active Scanning (RF/Optical)

Description

Active scanning moves beyond passive collection: an adversary transmits or injects probes intended to elicit identifiable responses that reveal frequencies, protocols, or device behavior. Examples include stimulating auto-track or auto-reply beacons, provoking ranging responses, tickling access schemes (TDMA/FDMA bursts), or sending benign-looking frames to observe AGC, saturation, or error counters. Optical/lasercom analogs include alignment pings or modulation patterns that solicit acquisition messages. The objective is RF “banner grabbing”, learning enough to build compatible demod/decoder chains or to map control surfaces, without necessarily breaching authentication. Because scans can resemble normal acquisition attempts, they may blend into the noise floor of operations.

Mappings

EU regulation articles

eu-space-actArt. 85(1)
addresses
moderate
inferred
Art. 85(1)'s cryptographic concept is domain-relevant to active-scanning recon, but RF emissions are observable regardless of crypto; emission discipline and LPI waveforms (signal-domain) would interdict it.
nis2Art. 21(2)(b)
addresses
moderate
derived
Active probes that elicit auto-track responses, ranging tones, or AGC reactions are observable anomalies the entity's incident-handling capability under Art. 21(2)(b) must surface via spectrum-monitoring and baseline deviation detection.
nis2-implAnnex 3.2.1
addresses
moderate
direct
Active scanning is observable: the entity's monitoring-and-logging procedures must surface anomalous probe responses, frequency-sweep correlation and TT&C link-margin changes that signal an adversary scan.

ENISA controls

ENISA-STL-2025-03-sD.29-i01
addresses
moderate
Boundary monitoring on RF and network entry points is the operator-side mechanism that detects active probing of mission systems.
ENISA-STL-2025-03-sD.29-i08
addresses
high
Space-based RF mapping detects active scanning emissions and distinguishes them from background interference, addressing this technique directly.

Cross-reference controls

csf-2-0PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
addresses
moderate
Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records REC-0005.04 against SI-4 System Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for PR.DS-01. Through SPARTA: SPARTA's catalog maps REC-0005.04 to countermeasure CM0002 COMSEC, and that countermeasure's own CSF references include PR.DS-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.
csf-2-0PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
addresses
moderate
Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records REC-0005.04 against SI-4 System Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for PR.DS-02. Through SPARTA: SPARTA's catalog maps REC-0005.04 to countermeasure CM0002 COMSEC; CM0029 TRANSEC, and that countermeasure's own CSF references include PR.DS-02. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.
mitre-attack-enterpriseT1595 Active Scanning
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-17 Remote Access
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-17(1)Monitoring and Control
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-17(10)Authenticate Remote Commands
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-17(2)Protection of Confidentiality and Integrity Using Encryption
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-18 Wireless Access
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-18(1)Authentication and Encryption
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-18(5)Antennas and Transmission Power Levels
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-2(11)Usage Conditions
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-3(10)Audited Override of Access Control Mechanisms
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5CA-3 Information Exchange
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5CP-8 Telecommunications Services
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5IA-4(9)Attribute Maintenance and Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5IA-5 Authenticator Management
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5IA-5(7)No Embedded Unencrypted Static Authenticators
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5IA-7 Cryptographic Module Authentication
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5PL-8 Security and Privacy Architectures
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5PL-8(1)Defense in Depth
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-8(18)Trusted Communications Channels
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-8(19)Continuous Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-9(6)Organization-controlled Cryptographic Keys
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-10 Network Disconnect
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-12 Cryptographic Key Establishment and Management
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-12(1)Availability
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-12(2)Symmetric Keys
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-12(3)Asymmetric Keys
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-12(6)Physical Control of Keys
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-13 Cryptographic Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-16 Transmission of Security and Privacy Attributes
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-16(1)Integrity Verification
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-16(3)Cryptographic Binding
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-26 Decoys
addresses
moderate
SC-26 (Decoys) mitigates active scanning by attracting probes to instrumented honeyspots.
nist-80053-rev5SC-28(1)Cryptographic Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-28(3)Cryptographic Keys
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-30 Concealment and Misdirection
mitigates
moderate
SC-30 mitigates active scanning by misdirecting probes through concealment of true service signatures.
nist-80053-rev5SC-40 Wireless Link Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-40(1)Electromagnetic Interference
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-40(3)Imitative or Manipulative Communications Deception
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-40(4)Signal Parameter Identification
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-5 Denial-of-service Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-7 Boundary Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-7(10)Prevent Exfiltration
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-7(11)Restrict Incoming Communications Traffic
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-7(18)Fail Secure
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-7(5)Deny by Default — Allow by Exception
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-8(1)Cryptographic Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-8(3)Cryptographic Protection for Message Externals
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-8(4)Conceal or Randomize Communications
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-10 Information Input Validation
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-10(3)Predictable Behavior
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-10(5)Restrict Inputs to Trusted Sources and Approved Formats
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-10(6)Injection Prevention
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-19(4)Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-3(8)Detect Unauthorized Commands
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-4 System Monitoring
addresses
moderate
SI-4 (System Monitoring) mitigates active scanning by detecting probe traffic and triggering response.
nist-80053-rev5SI-4(11)Analyze Communications Traffic Anomalies
addresses
moderate
SI-4(11) (Analyze Communications Traffic Anomalies) mitigates active scanning by surfacing scan-pattern anomalies.
space-shieldT2001 Active Scanning (RF/Optical)
addresses
high
T2001 'Active Scanning (RF/Optical)' is the exact title-and-scope counterpart of REC-0005.04 Active Scanning (RF/Optical).

SPARTA countermeasures

CM0002 COMSEC
Mapped by SPARTA, not curated by SafeMode Space.
CM0029 TRANSEC
Mapped by SPARTA, not curated by SafeMode Space.

Cite as SafeMode Space, REC-0005.04 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description