system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Establish covert C2/exfiltration by abusing one-way satellite downlinks (Turla method)

Grounding:
- SPARTA EX-0012.12 System Clock: Spacecraft maintain multiple time bases and distribute time to schedule sequences, validate timetags, manage anti-replay counters, and align navigation/attitude processing. By writing to clock registers, altering time-distribution services, switching disciplining sources, or…
- SPARTA IA-0008.02 Rogue Spacecraft: Adversaries may employ their own satellite or hosted payload to achieve proximity and a privileged RF geometry. After phasing into the appropriate plane or drift orbit, the rogue vehicle operates as a local peer: emitting narrow-beam or crosslink-compatible signals, relaying…
- SPARTA EXF-0003.02 Downlink Exfiltration: The attacker records spacecraft-to-ground traffic, real-time telemetry, recorder playbacks, payload products, and mirrored command sessions, to obtain mission data and health/state information. With sufficient signal quality and protocol knowledge, frames and packets are…
- SPARTA RD-0005.03 Kinetic Physical ASAT: Kinetic capabilities physically strike space or ground elements. In space, direct-ascent systems launch from Earth to intercept a satellite on orbit; co-orbital systems maneuver in space to approach and impact a target. On the ground, kinetic attacks can target stations or…
- SPARTA EX-0001.02 Bus Traffic Replay: Instead of the RF path, the attacker targets internal command/data handling by injecting or retransmitting messages on the spacecraft bus (e.g., 1553, SpaceWire, custom). Because many subsystems act on the latest message or on message rate rather than on uniqueness, a flood of…
- SPARTA EXF-0003 Signal Interception: The adversary captures mission traffic in transit, on ground networks or over the space link, so that payload products, housekeeping, and command/ack exchanges can be reconstructed offline. Vantage points include tapped ground LANs/WANs between MOC and stations, baseband…
- SPARTA EX-0008 Time Synchronized Execution: Malicious logic is arranged to run at precise times derived from onboard clocks or distributed time sources. The trigger may be absolute or relative. Spacecraft commonly maintain multiple clocks and counters and schedule autonomous sequences against them. An attacker leverages…
- SPARTA REC-0005.01 Uplink Intercept Eavesdropping: Uplink reconnaissance focuses on capturing the command path from ground to spacecraft to learn telecommand framing, authentication fields, timing, and anti-replay behavior. Valuable artifacts include emission designators, symbol rates, polarization sense, Doppler profiles, and…

Decompose this objective into an ordered plan of verifiable steps.

assistant: Plan:
1. Find an unencrypted downlink and active subscriber IPs
   - Technique: REC-0005.01 Eavesdropping [ST0001]
   - Action: Survey one-way satellite internet downlinks for unencrypted broadcast traffic and identify IP addresses of legitimate subscribers to impersonate as destinations.
   - Check: live subscriber IPs are observed on an unencrypted downlink.
2. Send victim traffic to a subscriber IP so replies broadcast over the footprint
   - Technique: EXF-0003.02 Downlink Exfiltration [ST0008]
   - Action: Direct infected hosts to a chosen subscriber IP; the provider relays replies over the broadcast downlink.
   - Check: data sent to the subscriber IP is observable on the downlink.
3. Passively receive the broadcast downlink from anywhere in the footprint
   - Technique: EXF-0003 Signal Interception [ST0008]
   - Action: Receive the replies with a cheap satellite dish from any location in the footprint, hiding the true C2 location.
   - Check: C2 traffic is received passively with no link back to the attacker location.