system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Command a satellite over an unauthenticated telecommand link (Space Odyssey class)

Grounding:
- SPARTA IA-0008 Rogue External Entity: Adversaries obtain a foothold by interacting with the spacecraft from platforms outside the authorized ground architecture. A “rogue external entity” is any actor-controlled transmitter or node, ground, maritime, airborne, or space-based, that can radiate or exchange traffic…
- SPARTA IMP-0004 Degradation: Measures designed to permanently impair (either partially or totally) the use of a system. Threat actors may target various subsystems or the hosted payload in such a way to rapidly increase it's degradation. This could potentially shorten the lifespan of the victim spacecraft.
- SPARTA REC-0001.03 Cryptographic Algorithms: Adversaries look for the complete crypto picture: algorithms and modes, key types and lifecycles, authentication schemes, counter or time-tag handling, anti-replay windows, link-layer protections, and any differences between uplink and downlink policy. With algorithm and key…
- SPARTA IA-0004.01 Ground Station: Threat actors may target the backup ground segment, standby MOC sites, alternate commercial stations, or contingency chains held in reserve. Threat actors establish presence on the backup path (operator accounts, scheduler/orchestration, modem profiles, antenna control) and…
- SPARTA IA-0004 Secondary/Backup Communication Channel: Adversaries pursue alternative paths to the spacecraft that differ from the primary TT&C in configuration, monitoring, or authentication. Examples include backup MOC/ground networks, contingency TT&C chains, maintenance or recovery consoles, low-rate emergency beacons, and…
- SPARTA EX-0012 Modify On-Board Values: The attacker alters live or persistent data that the spacecraft uses to make decisions and route work. Targets include device and control registers, parameter and limit tables, internal routing/subscriber maps, schedules and timelines, priority/QoS settings, watchdog and timer…
- SPARTA REC-0009 Gather Mission Information: Adversaries compile a CONOPS-level portrait of the mission to predict priorities, constraints, and operational rhythms. They harvest stated needs, goals, and performance measures; enumerate key elements/instruments and their duty cycles; and extract mode logic, operational…
- SPARTA REC-0003 Gather Spacecraft Communications Information: Threat actors assemble a detailed picture of the mission’s RF and networking posture across TT&C and payload links. Useful elements include frequency bands and allocations, emission designators, modulation/coding, data rates, polarization sense, Doppler profiles, timing and…

Steps so far:
1. Characterize the commanding protocol [REC-0003]
2. Stand up a rogue uplink [IA-0008]

Give the single next step.

assistant: 3. Issue an unauthenticated telecommand
   - Technique: EX-0012 Modify On-Board Values [ST0004]
   - Action: Send a command that is executed because no authentication is enforced on the link.
   - Check: on-board value changes to the commanded setting on the bench.