SCOR SPACE-SHIELD Tactics

ESA SPACE-SHIELD Tactics adapted to SCOR namespace for matrix rendering in MISP.

Authors

Authors and/or Contributors
H4CK32N4U75®

Reconnaissance

Gather information about the targeted system to identify critical assets, weakest links, and exploitable surfaces. Includes RF/optical interception and in-orbit intelligence.

Internal MISP references

UUID 47c7ab44-0c0c-4dbc-b2a5-6e997c06d4c9 which can be used as unique global reference for Reconnaissance in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0043
shortname	reconnaissance

Resource Development

Establish resources to support operations, including infrastructure, tooling, compromised accounts, and capabilities.

Internal MISP references

UUID 1c60f612-ebd2-4b2a-bdd7-a863ab510930 which can be used as unique global reference for Resource Development in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0042
shortname	resource-development

Initial Access

Gain an initial foothold in the targeted space system or ground segment, often through compromised ground systems, trusted relationships, or RF link exploitation.

Internal MISP references

UUID 8f285911-3f63-45a1-b354-733d0e93622b which can be used as unique global reference for Initial Access in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0001
shortname	initial-access

Execution

Run adversary-controlled or malicious commands or code within spacecraft or ground systems to achieve specific goals.

Internal MISP references

UUID 54f3f532-0e55-42cf-b1a2-ffe6a9471b95 which can be used as unique global reference for Execution in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0002
shortname	execution

Persistence

Maintain undetected access over time through methods such as backdoors, pre-launch insertion, or credential persistence.

Internal MISP references

UUID d60a563a-3e52-469f-9cc3-0453b82a33f6 which can be used as unique global reference for Persistence in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0003
shortname	persistence

Privilege Escalation

Obtain higher-level permissions or control, for example by becoming bus master or escaping virtualization boundaries.

Internal MISP references

UUID 384bf4d4-7cc8-4ef0-bb11-a2ad0a75daf1 which can be used as unique global reference for Privilege Escalation in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0004
shortname	privilege-escalation

Defense Evasion

Avoid detection or neutralize defensive measures by impairing defenses, removing indicators, or masquerading activity.

Internal MISP references

UUID d346427a-5eea-4a12-8513-74c7de879f96 which can be used as unique global reference for Defense Evasion in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0005
shortname	defense-evasion

Credential Access

Steal or obtain credentials, including TT&C master/session keys or authentication tokens, through brute force, interception, or key recovery.

Internal MISP references

UUID 84796fc4-6bee-4cfd-b53a-d06bbaba0bba which can be used as unique global reference for Credential Access in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0006
shortname	credential-access

Discovery

Gain knowledge about system structure, configuration, services, and trust relationships to inform further actions.

Internal MISP references

UUID 13b146bd-6440-442e-83dc-4bb0e40e1797 which can be used as unique global reference for Discovery in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0007
shortname	discovery

Lateral Movement

Move to other components or subsystems through compromised partitions, payload-platform pivots, or relay mechanisms.

Internal MISP references

UUID 91d5e680-f092-4f1c-9171-31cfeb8e38c8 which can be used as unique global reference for Lateral Movement in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0008
shortname	lateral-movement

Collection

Gather and centralize data from compromised assets, typically through link interception or adversary-in-the-middle operations.

Internal MISP references

UUID c0d977cd-c117-462d-923d-451d2fc48f82 which can be used as unique global reference for Collection in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0009
shortname	collection

Exfiltration

Exfiltrate data through TM/payload channels, leveraging the broad RF footprint of space downlinks or optical links.

Internal MISP references

UUID ff9da0f2-cd1e-463f-86be-17bf1c737212 which can be used as unique global reference for Exfiltration in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0010
shortname	exfiltration

Command and Control

Establish and maintain communication channels with compromised space or ground systems to orchestrate operations.

Internal MISP references

UUID 1fa6eabf-c066-4d01-ae54-170da2a9330e which can be used as unique global reference for Command and Control in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0011
shortname	command-and-control

Impact

Disrupt, degrade, or destroy the targeted system, its services, or physical platform through kinetic, electromagnetic, or operational effects.

Internal MISP references

UUID 6b1c12f9-79d1-4616-a216-926abd43ab70 which can be used as unique global reference for Impact in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value
id	TA0040
shortname	impact