TLP:GREEN Limited Disclosure · SCORP² community members only

Exported by: verifying identity… Exported at: …

Distribution notice. This document is for active SCORP² community members only. Unauthorized distribution will result in revocation of community membership.

Incident Response Preparation · Kestrel Orbital Worked Example

Writes the RootA signature and the response playbook against the attack path delivered upstream

Incident Response Preparation takes each attack path and its source inventory (both delivered by Converged Detection Engineering) and produces two outputs: the detection signature that fires on the upstream source for a step, and the response playbook the Security Operations Center runs the moment the signature fires. Signatures are written in RootA.io, the open vendor-neutral detection language, and attach via TDM (Target of Detection Method) to the structural element the rule observes.

Platform anchor. AST : SI : Signal : 00 · telecommand uplink waveform.
Threat. AN : THR : Threat : 00 · KO-THR-01. TOE → orbital command environment.
Attack path. AN : ATT : Attack Path : 00 · uplink access → defeat Link ACA → C&DH accept → execute on OBC.

Source inventory inherited from Converged Detection Engineering. The sources this signature consumes (src-acalink-002, src-cdh-003) are enumerated against the steps of AN : ATT : Attack Path : 00 upstream. Incident Response Preparation reads the inventory and writes the signature; it does not produce the inventory.

DETEnumerated AN-DET

Field	Value
Identifier	AN : DET : Detection Signature : 00
Description	RootA rule that fires when a telecommand reaches the vehicle command path without a valid authenticated context at the Link access-control service, or when its message-authentication-code fails to verify.
TDM	AN : DET : Detection Signature : 00 via TDM → SVC : CP : Control Plane : 05 (Link ACA)
Back-references	AN : ATT : Attack Path : 00
Sources read	`src-acalink-002`, `src-cdh-003`
Test result	FP rate < 1% on a 30-day baseline of authenticated ground commanding; TP rate confirmed in red-team exercise RT-2026-Q1.
Source	Detection rule pack v2.4; test results TS-2026-Q2.

RootA signature (excerpt)

# meteorstorm.telecommand.unauthenticated-uplink
name: meteorstorm.telecommand.unauthenticated-uplink
title: Unauthenticated telecommand accepted on the command uplink
description: |
  Detects a telecommand that reaches the vehicle command path without a
  valid authenticated context at the Link access-control service, or whose
  message-authentication-code fails to verify. Designed against the Kestrel
  Orbital telecommand-injection path.
references:
  - meteorstorm: AN : ATT : Attack Path : 00
  - meteorstorm: AN : THR : Threat : 00
  - kestrel: KO-INTEL-2026-014
status: stable
author: SCORP² community
tags:
  - meteorstorm.detection-signature
  - tdm.svc-cp-controlplane-05
  - kestrel-orbital.telecommand
logsource:
  product: command-authentication-service
  category: telecommand
detection:
  selection_command:
    message_class: telecommand
    reached_stage: cdh-accept
  filter_authenticated:
    mac_verified: true
    source_authenticated: true
  condition: selection_command and not filter_authenticated
fields:
  - uplink_carrier_id
  - command_apid
  - mac_result
  - source_auth_context
  - command_counter
falsepositives:
  - Ground-authorized commanding whose message-authentication-code verifies
    (filter passes; no alert).
level: high

Response playbook (paired with the signature)

Trigger	`AN : DET : Detection Signature : 00` fires.
Immediate	Satellite Operations confirms whether the command was executed on the vehicle (correlate with `src-cdh-003` and OBC execution log); if executed, invoke command-inhibit and safe-mode procedures.
Contain	Security Operations blocks the offending uplink source where controllable; Satellite Operations tightens command acceptance to authenticated-only for the pass.
Report	Open the NIS2 clock: 24-hour early warning, 72-hour notification, one-month report; log EO 14144 detect-report-recover evidence.
Owner	Security Operations Center, with Satellite Operations on the vehicle actions.

Annotation criteria for every AN-DET element

Field	Required?	What to capture
LAYER / TAG / LABEL / ORDINAL	Required	Always `AN : DET : Detection Signature : NN`.
DESCRIPTION	Required	What the rule detects, in plain English. One short paragraph; no marketing.
TDM	Required	Fully-qualified enumerated identifier of the structural element the signature is deployed against and tested on. Not `TOE`.
BACK-REFERENCES	Required	The `AN-ATT` elements (and optionally `AN-IOC` / `AN-IOA`) the signature covers. No orphan signatures.
SOURCES READ	Required	Enumerated source identifiers (the `src-*` rows) the rule consumes.
RULE	Required	RootA YAML, attached or referenced. Sigma or Yara accepted as adjuncts for non-RootA-native sources.
TEST RESULT	Required	FP rate, TP rate, test data set or red-team reference. A signature without test evidence does not graduate.
SOURCE	Required	The rule pack version and test-result document the entry was derived from.

No orphan signatures, no signature without a playbook. Every AN-DET back-references at least one AN-ATT and ships paired with the response playbook the Security Operations Center runs when it fires.