TLP:GREEN Limited Disclosure · SCORP² community members only

Exported by: verifying identity… Exported at: …

Distribution notice. This document is for active SCORP² community members only. Unauthorized distribution will result in revocation of community membership.

Converged Detection Engineering · Kestrel Orbital Worked Example

Traces the attack path and the data and signal sources needed to detect each step

Converged Detection Engineering turns each AN-THR into one or more AN-ATT entries and, for each step on each path, enumerates the data and signal sources needed to observe it. Each attack path is the ordered chain of Kestrel Orbital structural elements the adversary touches from initial access to objective, anchored by TOE references; the source inventory aligned to those steps is the second deliverable. Incident Response Preparation uses both to write detection signatures and playbooks.

Platform anchor. AST : SI : Signal : 00 · telecommand uplink waveform. Objective element AST : HW : Hardware : 06 (on-board computer).
Threat anchor. AN : THR : Threat : 00 · KO-THR-01. TOE → PCE : OR : Orbital : 00.

ATTEnumerated AN-ATT

One concrete path an adversary realising the threat would traverse, from uplink access to command execution on the vehicle.

Field	Value
Identifier	AN : ATT : Attack Path : 00
Description	Unauthenticated telecommand injection on the uplink: gain transmit access on the command uplink → present a forged telecommand to the Link access-control service → command accepted and routed by C&DH → command executed on the on-board computer.
Driven by	AN : THR : Threat : 00 (KO-THR-01)
TOE chain (in order of traversal)	AST : SI : Signal : 00 → SVC : CP : Control Plane : 05 → SVC : HY : Hybrid : 00 → AST : HW : Hardware : 06
Source	Kestrel Orbital red-team exercise RT-2026-Q1; command-link injection reconstruction against the Day-1 CONOPS uplink chain.
Confidence	High. Every step maps to a real enumerated element on the command path; the traversal was reproduced in the red-team exercise.

Step-by-step adversary actions on this path

Step 01 · Uplink accessGain transmit access on the command uplinkAdversary establishes the ability to transmit a conforming waveform on the telecommand uplink frequency and framing. TOE: AST : SI : Signal : 00

Step 02 · Defeat command authenticationPresent a forged telecommand to the Link access-control serviceAdversary submits a telecommand crafted to pass or bypass source authentication at the Link ACA, where weak or absent command authentication lets an unauthenticated command through. TOE: SVC : CP : Control Plane : 05

Step 03 · Command acceptanceCommand accepted and routed by C&DHThe command and data handling service accepts the command as valid and routes it to the flight software for execution. TOE: SVC : HY : Hybrid : 00

Step 04 · Action on objectiveCommand executed on the on-board computerThe on-board computer executes the injected command, giving the adversary an effect on the vehicle. TOE: AST : HW : Hardware : 06

Annotation criteria for every AN-ATT element

Field	Required?	What to capture
LAYER / TAG / LABEL / ORDINAL	Required	Always `AN : ATT : Attack Path : NN`.
DESCRIPTION	Required	One short narrative of the path from initial access to objective; no marketing.
DRIVEN BY	Required	The `AN-THR` the path realises. Each AN-ATT names exactly one driver; cross-reference others.
TOE chain	Required	Ordered list of every structural element the adversary touches, written as fully-qualified enumerated identifiers.
STEPS	Recommended	One bullet per traversal step, each naming the structural element it touches. Drives the source inventory and the detection scope inherited downstream.
SOURCE	Required	Red-team report, public incident analysis, government brief, or peer ISAC bulletin. Hypothetical paths must be marked exercise-only and segregated.
CONFIDENCE	Recommended	How well the path is corroborated.

SRCData and signal source inventory

For each step on AN : ATT : Attack Path : 00, the data or signal source a defender needs to observe the step. Where no source exists, mark a detection gap. This inventory is a Converged Detection Engineering deliverable, read by Incident Response Preparation when authoring signatures.

Path step (TOE)	Required data / signal source	Status on this platform
AST : SI : Signal : 00	RF spectrum and uplink demodulation telemetry; unexpected carrier, framing, or command cadence on the command uplink.	Available; onboarded as `src-rf-001`.
SVC : CP : Control Plane : 05	Link access-control audit: command source-authentication accept/reject and message-authentication-code verification result.	Available; onboarded as `src-acalink-002`.
SVC : HY : Hybrid : 00	C&DH command receipt and routing log; command-counter continuity and out-of-sequence detection.	Available; onboarded as `src-cdh-003`.
AST : HW : Hardware : 06	On-board computer command-execution log and FDIR events; unexpected command sequence on the bus.	Partial; execution logging present, FDIR event export to ground gap recorded as `gap-obc-004`.

Validation rules. Before declaring the source inventory complete: every AN-ATT step has at least one row; every "Available" status names a real source identifier the SIEM operator can resolve; gaps are recorded explicitly and assigned an owner before launch.

Attack path vs detection signature, kept clear. Converged Detection Engineering produces the map of paths and the source inventory aligned to each step. It does not produce signatures or playbooks. Those are Incident Response Preparation outputs. Mixing the two is the most common anti-pattern.

Attack path vs threat, kept clear. AN-THR is the actor and intent. AN-ATT is the traversal through the platform. One AN-THR can drive many AN-ATT paths.