name: Management-plane firmware-push abuse on the ground command-acceptance service
details: |
  Detects firmware-push and configuration-deploy operations released through the ground
  command-acceptance service outside an authorized maintenance window. The pattern follows the
  KA-SAT incident of 28 February 2022, where the modem management interface was abused to push
  AcidRain wiper firmware to a subscriber fleet. Corroborating streams the analyst should pull on
  a hit, which are not the target of this rule: the patch binary store hash audit and the patch
  deployment pipeline execution log. Known benign causes: an emergency change carrying a
  documented incident reference, and an authorized red-team exercise.
author: Kestrel Orbital SOC
severity: critical
type: alert
class: behavioral
date: 2026-08-04
mitre-attack:
    - t1542.005
    - t1195.002
detection:
    language: splunk-spl-query
    body: index=ground_aca sourcetype=mgmt_plane_audit event_action IN ("firmware_push","config_deploy","image_install") target_device="*modem*" maintenance_window=false | stats count by user, src_ip, target_device, event_action
logsource:
    product: ground-aca
    service: management-plane
    audit:
        source: Ground ACA management-plane audit log
        enable: Enable per-action management-plane auditing on the ground command-acceptance service, including the maintenance-window flag on every deploy event.
correlation:
    timeframe: 15m
    functions: count(event_action) by target_device
references:
    - AN:ATT:Attack Path:00
    - AN:THR:Threat:00
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a
    - https://www.viasat.com/about/newsroom/blog/ka-sat-network-cyber-attack-overview/
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
tags: KO-DET-MGMT-PUSH-001, firmware-push, ground-aca, ka-sat
license: DRL 1.1
version: 1.0
uuid: 6d1f2a83-9c47-4b10-8e5d-1f3a7c9b2e04
meteorstorm:
    pce: PCE:TE:Terrestrial:00
    seg: SEG:GR:Ground:00
    svc: SVC:CP:Control Plane:09
    playbook: PB-00
    an:
        eten: AN:DET:Detection Signature:00
        tdm: SVC:CP:Control Plane:09