name: AN-DET-13 Payload-data integrity mismatch
details: |
  Detects tampering of on-orbit payload data between acquisition and ground delivery. Watches the
  payload data plane (SVC:DP:Data Plane:01) and ground mission-product service (SVC:DP:Data Plane:00)
  for signature failures on on-board-signed payload products. Implements AN-DET:13.
author: ethicallyHackingSpace
severity: high
type: query
class: integrity_anomaly
status: stable
date: 2026-06-07
mitre-attack:
  - T1565.002
references:
  - https://sparta.aerospace.org/technique/SPACE-T1059
tags:
  - meteorstorm.an-det.13
  - meteorstorm.tdm.svc-dp-data-plane-00
  - meteorstorm.tdm.svc-dp-data-plane-01
  - meteorstorm.tdm.ast-hw-hardware-07
  - sparta.SPACE-T1059
logsource:
  product: ground_mission_product_service
  category: data_integrity
detection:
  selection_payload_origin:
    product_source: "on_board_signed"
  selection_signature_invalid:
    onboard_signature_valid: false
  condition: selection_payload_origin and selection_signature_invalid
falsepositives:
  - Calibration data with vendor advisory waiver (requires authorized exception)