system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Re-execute a privileged action by replaying a captured telecommand (no anti-replay)

Grounding:
- SPARTA EX-0012 Modify On-Board Values: The attacker alters live or persistent data that the spacecraft uses to make decisions and route work. Targets include device and control registers, parameter and limit tables, internal routing/subscriber maps, schedules and timelines, priority/QoS settings, watchdog and timer…
- SPARTA REC-0003 Gather Spacecraft Communications Information: Threat actors assemble a detailed picture of the mission’s RF and networking posture across TT&C and payload links. Useful elements include frequency bands and allocations, emission designators, modulation/coding, data rates, polarization sense, Doppler profiles, timing and…
- SPARTA IA-0008.02 Rogue Spacecraft: Adversaries may employ their own satellite or hosted payload to achieve proximity and a privileged RF geometry. After phasing into the appropriate plane or drift orbit, the rogue vehicle operates as a local peer: emitting narrow-beam or crosslink-compatible signals, relaying…
- SPARTA IA-0008.03 ASAT/Counterspace Weapon: Adversaries leverage counterspace platforms to create conditions under which initial execution becomes possible or to impose effects directly. Electronic warfare systems can jam or spoof links so that the target shifts to contingency channels or accepts crafted…
- SPARTA DE-0003.05 Command Receiver Lock Modes: Receivers advertise acquisition states, bit lock, frame lock, and command lock, that indicate readiness to accept telecommands. Adversaries leverage these indicators in two ways: (1) use command-lock tests to validate geometry, power, Doppler, and polarization without risking…
- SPARTA EX-0001 Replay: Replay is the re-transmission of previously captured traffic, over RF links, crosslinks, or internal buses, to elicit the same processing and effects a second time. Adversaries first observe and record authentic exchanges (telecommands, ranging/acquisition frames, housekeeping…
- SPARTA EXF-0003 Signal Interception: The adversary captures mission traffic in transit, on ground networks or over the space link, so that payload products, housekeeping, and command/ack exchanges can be reconstructed offline. Vantage points include tapped ground LANs/WANs between MOC and stations, baseband…
- SPARTA DE-0003.11 Watchdog Timer (WDT) for Evasion: By modifying watchdog parameters or who “pets” them, an adversary shapes what evidence survives. Extending or disabling timeouts allows long-running processes to operate without forced resets that would expose abnormal CPU or power usage; conversely, shortening windows or…

Steps so far:
1. Characterize the acceptance window [REC-0003]
2. Capture an authentic telecommand [EXF-0003]
3. Replay the captured frame [EX-0001]

Give the single next step.

assistant: 4. Re-apply the on-board state change
   - Technique: EX-0012 Modify On-Board Values [ST0004]
   - Action: The replayed command re-applies its state change on the target.
   - Check: on-board value returns to the replayed setting.