system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Verify the serial console is not an unauthenticated foothold on the flight build

Grounding:
- SPARTA REC-0005.04 Active Scanning (RF/Optical): Active scanning moves beyond passive collection: an adversary transmits or injects probes intended to elicit identifiable responses that reveal frequencies, protocols, or device behavior. Examples include stimulating auto-track or auto-reply beacons, provoking ranging…
- SPARTA EX-0008.02 Relative Time Sequences: Execution is keyed to elapsed time since a reference event. The implant latches a start point, boot, reset, safing entry/exit, receipt of a particular telemetry/command pattern, achievement of sun-pointing, and arms a countdown or set of offsets (“N seconds after event,”…
- SPARTA REC-0001 Gather Spacecraft Design Information: Threat actors seek a coherent picture of the spacecraft and its supporting ecosystem to reduce uncertainty and plan follow-on actions. Useful design information spans avionics architecture, command and data handling, comms and RF chains, power and thermal control, flight…
- SPARTA IA-0005.03 Proximity Grappling: In this variant, the attacker employs a capture mechanism (robotic arm, grappling fixture, magnetic or mechanical coupler) to establish physical contact without full docking. Once grappled, covers can be manipulated, temporary umbilicals attached, or exposed test points…
- SPARTA EX-0004 Compromise Boot Memory: The attacker manipulates memory and configuration used in the earliest stages of boot so that their code runs before normal protections and integrity checks take hold. Targets include boot ROM vectors, first-stage/second-stage bootloaders, boot configuration words and strap…
- SPARTA RD-0002.02 3rd Party Ground System: Third-party networks (commercial ground stations, hosted modems, cloud-integrated ground-station services) present attractive stepping-stones: they already have vetted RF chains, globally distributed apertures, and trusted IP space. Adversaries may acquire customer credentials…
- SPARTA PER-0002 Backdoor: A backdoor is a covert access path that bypasses normal authentication, authorization, or operational checks so the attacker can reenter the system on demand. Backdoors may be preexisting (undocumented service modes, maintenance accounts, debug features) or introduced by the…
- SPARTA REC-0001.02 Firmware: Firmware intelligence covers microcontroller images, programmable logic bitstreams, boot ROM behavior, peripheral configuration blobs, and anti-rollback or secure-boot settings for devices on the bus. Knowing device types, versions, and footprints enables inference of default…

Steps so far:
1. Identify the UART interface [REC-0001.02]
2. Test for an unauthenticated console [PER-0002]

Give the single next step.

assistant: 3. Test for a bootloader interrupt
   - Technique: EX-0004 Compromise Boot Memory [ST0004]
   - Action: Attempt to interrupt the bootloader over the console to reach a lower-level prompt.
   - Check: flight build ignores the interrupt rather than dropping to a bootloader prompt.