name: AN-DET-07 Sustained RF noise-floor anomaly (jamming)
details: |
  Detects sustained noise-floor anomalies across uplink and downlink RF bands consistent with
  intentional jamming. Watches RF metric streams from T2 tracking (SVC:HY:Hybrid:02) and the
  uplink/downlink waveform telemetry (AST:SI:Signal:00) for SNR drop, BER spike, or sustained
  out-of-band emission. Implements AN-DET:07.
author: ethicallyHackingSpace
severity: high
type: query
class: rf_anomaly
status: stable
date: 2026-06-07
mitre-attack:
  - T1498
references:
  - https://sparta.aerospace.org/technique/SPACE-T1429
tags:
  - meteorstorm.an-det.07
  - meteorstorm.tdm.svc-hy-hybrid-02
  - meteorstorm.tdm.ast-si-signal-00
  - sparta.SPACE-T1429
  - attack.impact
logsource:
  product: ground_rf_telemetry
  category: rf_metrics
detection:
  selection_snr_drop:
    snr_db|delta_below_baseline: ">=8"
    duration_seconds: ">=120"
  selection_ber_spike:
    bit_error_rate|above_baseline_factor: ">=10"
    duration_seconds: ">=120"
  selection_oob_emission:
    out_of_band_power_db|above_baseline: ">=6"
    duration_seconds: ">=60"
  condition: selection_snr_drop or selection_ber_spike or selection_oob_emission
falsepositives:
  - Solar storm or scintillation event (correlate with space-weather feed)
  - Authorized RF interference test