The SPACE-SHIELD (Space Attacks and Countermeasures Engineering Shield) is an ATT&CK® like knowledge-base framework for Space Systems. It is a collection of adversary tactics and techniques, and a security tool applicable in the Space environment to strengthen the security level. It is composed by threats that are relevant for Space systems, leveraging the available and related literature. The Matrix is tailored on the Space Segment and communication links, and it does not address specific types of mission, maintaining a broad and general point of view.

This tool is addressed to Cyber and System security teams to complement Cyber Threat Intelligence for Space in projects like SCCoE and CSoC, and to teams involved in preliminary phases of projects to consider the security during the design.

For contributions and feedback, please reach us at spaceshield@esa.int, and have a look at the Contribute page.

This is a custom instance of the ATT&CK Website built from source code published by ATT&CK on GitHub.

Space Attacks and Countermeasures Engineering Shield (SPACE-SHIELD)

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
6 techniques 4 techniques 5 techniques 3 techniques 4 techniques 2 techniques 4 techniques 4 techniques 4 techniques 4 techniques 2 techniques 3 techniques 5 techniques 12 techniques
Active Scanning (RF/Optical) (4)
=
Gather Victim Mission Information (3)
=
Gather Victim Org Information (3)
=
In orbit proximity intelligence (6)
=
Passive Interception (RF/Optical) (4)
=
Phishing for Information (2)
=
Acquire or Build Infrastructure (4)
=
Compromise Account (1)
=
Compromise Infrastructure (2)
=
Develop/Obtain Capabilities (9)
=
Direct Attack to Space Communication Links (2)
=
Ground Segment Compromise (2)
=
Supply Chain Compromise (3)
=
Trusted Relationship (3)
=
Valid Credentials (3)
=
Modification of On Board Control Procedures modification
Native API
Payload Exploitation to Execute Commands
Backdoor Installation (5)
=
Key Management Infrastructure Manipulation (2)
=
Pre-OS Boot (1)
=
Valid Credentials (3)
=
Become Avionics Bus Master
Escape to Host (1)
=
Impair Defenses (1)
=
Indicator Removal on Host (1)
=
Masquerading
Pre-Os Boot (1)
=
Adversary in the Middle (1)
=
Brute Force (1)
=
Communication Link Sniffing (1)
=
Retrieve TT&C master/session keys (3)
=
Key Management Policy Discovery
Spacecraft's Components Discovery
System Service Discovery
Trust Relationships Discovery
Compromise a Payload after compromising the main satellite platform
Compromise of another partition in Time and Space Partitioning OS or other types of satellite hypervisors
Compromise the satellite platform starting from a compromised payload
Lateral Movement via common Avionics Bus
Adversary in the Middle (2)
=
Data from link eavesdropping (3)
=
Protocol Tunnelling
Telecommand a Spacescraft (3)
=
TT&C over ISL
Exfiltration Over Payload Channel
Exfiltration Over TM Channel
Optical link modification
RF modification
Side-channel exfiltration
Data Manipulation (3)
=
Ground Segment Jamming (1)
=
Loss of spacecraft telecommanding (1)
=
Permanent loss to telecommand satellite (1)
=
Resource damage (7)
=
Resource Hijacking
Saturation of Inter Satellite Links (1)
=
Saturation/Exhaustion of Spacecraft Resources (5)
=
Service Stop (2)
=
Spacecraft Jamming (3)
=
Temporary loss to telecommand satellite (1)
=
Transmitted Data Manipulation
Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
6 techniques 4 techniques 5 techniques 3 techniques 4 techniques 2 techniques 4 techniques 4 techniques 4 techniques 4 techniques 2 techniques 3 techniques 5 techniques 12 techniques
=
Active Scanning (RF/Optical) (4)
=
Gather Victim Mission Information (3)
=
Gather Victim Org Information (3)
=
In orbit proximity intelligence (6)
=
Passive Interception (RF/Optical) (4)
=
Phishing for Information (2)
=
Acquire or Build Infrastructure (4)
=
Compromise Account (1)
=
Compromise Infrastructure (2)
=
Develop/Obtain Capabilities (9)
=
Direct Attack to Space Communication Links (2)
=
Ground Segment Compromise (2)
=
Supply Chain Compromise (3)
=
Trusted Relationship (3)
=
Valid Credentials (3)
Modification of On Board Control Procedures modification
Native API
Payload Exploitation to Execute Commands
=
Backdoor Installation (5)
=
Key Management Infrastructure Manipulation (2)
=
Pre-OS Boot (1)
=
Valid Credentials (3)
Become Avionics Bus Master
=
Escape to Host (1)
=
Impair Defenses (1)
=
Indicator Removal on Host (1)
Masquerading
=
Pre-Os Boot (1)
=
Adversary in the Middle (1)
=
Brute Force (1)
=
Communication Link Sniffing (1)
=
Retrieve TT&C master/session keys (3)
Key Management Policy Discovery
Spacecraft's Components Discovery
System Service Discovery
Trust Relationships Discovery
Compromise a Payload after compromising the main satellite platform
Compromise of another partition in Time and Space Partitioning OS or other types of satellite hypervisors
Compromise the satellite platform starting from a compromised payload
Lateral Movement via common Avionics Bus
=
Adversary in the Middle (2)
=
Data from link eavesdropping (3)
Protocol Tunnelling
=
Telecommand a Spacescraft (3)
TT&C over ISL
Exfiltration Over Payload Channel
Exfiltration Over TM Channel
Optical link modification
RF modification
Side-channel exfiltration
=
Data Manipulation (3)
=
Ground Segment Jamming (1)
=
Loss of spacecraft telecommanding (1)
=
Permanent loss to telecommand satellite (1)
=
Resource damage (7)
Resource Hijacking
=
Saturation of Inter Satellite Links (1)
=
Saturation/Exhaustion of Spacecraft Resources (5)
=
Service Stop (2)
=
Spacecraft Jamming (3)
=
Temporary loss to telecommand satellite (1)
Transmitted Data Manipulation