name: Firmware hash mismatch at boot on the on-board computer boot firmware
details: |
  Detects a measured boot firmware hash that does not match the signed vendor-supplied expected
  value, at power-on or after an update, which is how a subverted flight-software supply chain
  becomes visible on orbit. Corroborating streams the analyst should pull on a hit, which are not
  the target of this rule: the vendor signed-manifest and provenance attestation checked at
  acceptance, and the repeater firmware attestation record. Source state Gap: Kestrel does not
  currently fly measured boot, so the collection this rule reads does not yet exist. The
  collection that would close the gap is on-board measured boot with hardware-rooted attestation
  reported over the telemetry path, owner Satellite Design and Engineering. The rule and its
  playbook are enumerated now so both exist the day the collection lands.
author: Kestrel Orbital SOC
severity: critical
type: alert
class: behavioral
date: 2026-08-04
mitre-attack:
    - t1195.002
    - t1542.001
detection:
    language: splunk-spl-query
    body: index=obc_attestation sourcetype=measured_boot component_id="obc-firmware" measured_hash!=expected_hash | stats count by vehicle_id, boot_epoch, measured_hash, expected_hash
logsource:
    product: on-board-attestation
    service: measured-boot
    audit:
        source: On-board computer measured-boot attestation record
        enable: Not yet available on this platform. Requires on-board measured boot with hardware-rooted attestation, reported over the telemetry path. Declared as a coverage gap on Day 3, owner Satellite Design and Engineering.
correlation:
    timeframe: 1d
    functions: count(boot_epoch) by vehicle_id
references:
    - AN:ATT:Attack Path:03
    - AN:THR:Threat:03
    - https://csrc.nist.gov/publications/detail/sp/800-193/final
    - https://sparta.aerospace.org/technique/SPACE-T1041
tags: KO-DET-FW-HASH-001, supply-chain, measured-boot, detection-gap
license: DRL 1.1
version: 1.0
uuid: 9e05c3fa-7b18-4d62-b0a4-3c81f6d2705b
meteorstorm:
    pce: PCE:OR:Orbital:00
    seg: SEG:SP:Space:00
    svc: SVC:HY:Hybrid:00
    ast: AST:FW:Firmware:01
    playbook: PB-03
    an:
        eten: AN:DET:Detection Signature:03
        tdm: AST:FW:Firmware:01