system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Capture sensitive data by passively intercepting satellite broadband downlinks (Pavur method)

Grounding:
- SPARTA EX-0009.02 Operating System: At the OS layer the attacker targets primitives that schedule work and mediate hardware. Maintenance builds may expose shells or management consoles; misconfigurations around these interfaces can provide paths to command interpreters or privileged syscalls. Exploitation yields…
- SPARTA EXF-0003 Signal Interception: The adversary captures mission traffic in transit, on ground networks or over the space link, so that payload products, housekeeping, and command/ack exchanges can be reconstructed offline. Vantage points include tapped ground LANs/WANs between MOC and stations, baseband…
- SPARTA EXF-0003.02 Downlink Exfiltration: The attacker records spacecraft-to-ground traffic, real-time telemetry, recorder playbacks, payload products, and mirrored command sessions, to obtain mission data and health/state information. With sufficient signal quality and protocol knowledge, frames and packets are…
- SPARTA IA-0008 Rogue External Entity: Adversaries obtain a foothold by interacting with the spacecraft from platforms outside the authorized ground architecture. A “rogue external entity” is any actor-controlled transmitter or node, ground, maritime, airborne, or space-based, that can radiate or exchange traffic…
- SPARTA RD-0005 Obtain Non-Cyber Capabilities: Adversaries may pursue non-cyber counterspace means to create access, leverage, or effects that complement cyber operations. These capabilities span kinetic physical (e.g., direct-ascent or co-orbital interceptors and attacks on ground segments), non-kinetic physical (e.g.,…
- SPARTA IA-0012 Assembly, Test, and Launch Operation Compromise: Assembly, Test, and Launch Operation (ATLO) concentrates people, tools, and authority while components first exchange real traffic across flight interfaces. Test controllers, EGSE, simulators, flatsats, loaders, and data recorders connect to the same buses and command paths…
- SPARTA REC-0005.01 Uplink Intercept Eavesdropping: Uplink reconnaissance focuses on capturing the command path from ground to spacecraft to learn telecommand framing, authentication fields, timing, and anti-replay behavior. Valuable artifacts include emission designators, symbol rates, polarization sense, Doppler profiles, and…
- SPARTA IMP-0003 Denial: Measures designed to temporarily eliminate the use, access, or operation of a system for a period of time, usually without physical damage to the affected system. Threat actors may seek to deny ground controllers and other interested parties access to the victim spacecraft.…

Steps so far:
1. Point a consumer dish at a GEO broadband satellite [RD-0005]
2. Tune to the forward downlink and capture the stream [EXF-0003]

Give the single next step.

assistant: 3. Reassemble IP traffic and extract plaintext
   - Technique: EXF-0003.02 Downlink Exfiltration [ST0008]
   - Action: Parse the captured stream back into IP flows and pull out plaintext credentials, sessions, and operational data.
   - Check: readable application data is recovered without any key.