FIN7G0046 ↗
Used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.1
tfMITRE ATT&CK sub-technique
User Activity Based Checks T1497.002
sub-technique of T1497 Virtualization/Sandbox Evasion
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 06 March 2020
- Last modified
- 12 May 2026
- Contributor
- Deloitte Threat Library Team
Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.User Activity Based Checks MITRE reference T1497.002
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
DarkhotelG0012 ↗
Has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.1
All 2 groups for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
ROAMINGHOUSES9026 ↗
Can check for specific mouse movements and user activity before initiating malicious activity.1
TONESHELLS1239 ↗
Has leveraged GetForegroundWindow to detect virtualization or sandboxes by calling the API twice and comparing each window handle.1
SparkS0543 ↗
Has used a splash screen to check whether an user actively clicks on the screen before running malicious code.1
OkrumS0439 ↗
Loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.1
Cobalt StrikeS0154 ↗
The Cobalt Strike loader can use the MessageBoxA API to prompt for user interaction as an anti-sandbox measure.1
All 5 software entries for this technique
Offense vs defense T1497.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
User Activity Based Checks detection strategy DET0420
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect User Activity Based Sandbox Evasion via Input & Artifact Probing
3 platforms
AN1182 · Windows
Process execution that probes user activity artifacts (e.g., desktop files, registry history) following recent user login/unlock events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4800, 4801 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Window between user unlock and access to user history |
| UserContext | Focus on non-system accounts doing user activity probing |
AN1183 · Linux
Access to shell history or GUI input state (xdotool, xinput) for presence validation prior to payload execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | Reads of ~/.bash_history, ~/.mozilla, or access to /dev/input |
| Command ExecutionDC0064 | auditd:SYSCALL | Execution of xev, xdotool, or input activity emulators |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ArtifactCountThreshold | Number of distinct user files accessed before trigger |
| KnownToolSignatures | Suppress expected automation tools |
AN1184 · macOS
API usage or filesystem access revealing user state or browser artifacts (e.g., Safari bookmarks, CGEventState).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | macos:unifiedlog | Execution of input detection APIs (e.g., CGEventSourceKeyState) |
| File AccessDC0055 | macos:unifiedlog | Access to ~/Library/Safari/Bookmarks.plist or recent files |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Temporal correlation between login and file access |
| UserContext | Exclude expected UI activity from login agents |