name: Out-of-pattern command authority usage on the operator console software
details: |
  Detects command-authority usage outside the per-operator behavioral baseline: off-hours
  commanding, high-impact commands issued with no peer-review tag, and command sequences
  inconsistent with the active mission profile. Corroborating streams the analyst should pull on
  a hit, which are not the target of this rule: the operator console workstation usage stream and
  the satellite console command audit. Source state Partial: the peer-review tag stream depends
  on workflow adoption, so a command issued by a team that has not adopted the tag will not be
  distinguishable from one that skipped review. Known benign causes: operator travel filed with
  notice, and a documented emergency override carrying an incident ticket.
author: Kestrel Orbital SOC
severity: high
type: query
class: behavioral
date: 2026-08-04
mitre-attack:
    - t1078.003
detection:
    language: splunk-spl-query
    body: index=sat_command sourcetype=command_audit origin_device="operator-console" command_class IN ("fts_arm","thruster_burn","ranging_off","encryption_disable") AND (peer_review_tag=false OR date_hour<8 OR date_hour>17)
logsource:
    product: satellite_command_pipeline
    service: command_audit
    audit:
        source: Console operator software command audit
        enable: Enable per-command auditing on the console C2 application, including the peer-review tag and the issuing operator identity.
correlation:
    timeframe: 24h
    functions: count(command) by operator
references:
    - AN:ATT:Attack Path:01
    - AN:THR:Threat:01
    - https://attack.mitre.org/techniques/T1078/003/
    - https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
tags: KO-DET-CONSOLE-CMD-001, command-authority, operator-console
license: DRL 1.1
version: 1.0
uuid: 2b7c9d14-6f3a-4c58-9e21-7a0d5b3c8f46
meteorstorm:
    pce: PCE:TE:Terrestrial:00
    seg: SEG:GR:Ground:00
    svc: SVC:CP:Control Plane:13
    ast: AST:SW:Software:04
    playbook: PB-01
    an:
        eten: AN:DET:Detection Signature:01
        tdm: AST:SW:Software:04