system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Reach the commanding path of an on-orbit asset via a compromised ground station

Grounding:
- SPARTA IA-0008.01 Rogue Ground Station: Adversaries may field their own ground system, transportable or fixed, to transmit and receive mission-compatible signals. A typical setup couples steerable apertures and GPS-disciplined timing with SDR/modems configured for the target’s bands, modulation/coding, framing, and…
- SPARTA EX-0013.01 Valid Commands: Here the adversary saturates paths with legitimate telecommands or bus messages so the spacecraft burns scarce resources honoring them. Inputs may be innocuous (no-ops, time queries, telemetry requests) or low-risk configuration edits, but at scale they consume command handler…
- SPARTA EX-0001.01 Command Packets: Threat actors may resend authentic-looking telecommands that were previously accepted by the spacecraft. Captures may include whole command PDUs with framing, CRC/MAC, counters, and timetags intact, or they may be reconstructed from operator tooling and procedure logs. When…
- SPARTA IA-0006 Compromise Hosted Payload: Adversaries target hosted payloads as an alternate doorway into the host spacecraft. Hosted payloads often expose their own command sets, file services, and telemetry paths, sometimes via the host’s TT&C chain, sometimes through a parallel ground infrastructure under different…
- SPARTA REC-0003 Gather Spacecraft Communications Information: Threat actors assemble a detailed picture of the mission’s RF and networking posture across TT&C and payload links. Useful elements include frequency bands and allocations, emission designators, modulation/coding, data rates, polarization sense, Doppler profiles, timing and…
- SPARTA IA-0001.01 Software Dependencies & Development Tools: This technique targets what developers import and the tools that transform source into flight binaries. Methods include dependency confusion and typosquatting, poisoned container/base images, malicious IDE plugins, and compromised compilers, linkers, or build runners that…
- SPARTA IA-0007 Compromise Ground System: Compromising the ground segment gives an adversary the most direct path to first execution against a spacecraft. Ground systems encompass operator workstations and mission control mission control software, scheduling/orchestration services, front-end processors and modems,…
- SPARTA IA-0004.02 Receiver: Threat actors may target the spacecraft’s secondary (backup) RF receive path, often a differently sourced radio, alternate antenna/feed, or cross-strapped front end that is powered or enabled under specific modes. Threat actors map when the backup comes into play (safing,…

Steps so far:
1. Compromise the ground station or its internet connection [IA-0007]
2. Pivot to the spacecraft commanding interface [IA-0008.01]

Give the single next step.

assistant: 3. Achieve the ability to form accepted commands
   - Technique: EX-0013.01 Valid Commands [ST0004]
   - Action: Reach the point where valid commands could be issued to the spacecraft (the reported outcome: all steps required to command were achieved).
   - Check: a well-formed command is accepted by the (emulated) spacecraft command handler.