T1497.002 — User Activity Based Checks

Tactics: Stealth, Discovery · Platforms: Linux, macOS, Windows

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects…

Sub-technique of Virtualization/Sandbox Evasion (T1497).

Sigma detection rules (3)

T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks

title: "T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks"
id: b42efc35-161e-4641-a5cc-9e806f20da7c
description: 'Detect User Activity Based Sandbox Evasion via Input & Artifact Probing. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1497/002
author: Shahrukh Khan
date: 2026-01-21
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    CommandLine|contains:
      - 'Select-Object'
    CommandLine|contains|all:
      - 'Win32_ComputerSystem'
      - 'Model'

  condition: selection

falsepositives:
  - Legitimate asset-management and inventory scripts perform the same VM-fingerprint checks for entirely benign purposes.

level: informational

T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks

title: "T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks"
id: 85cd9131-9629-42e5-9ff2-411b5f5204b2
description: 'Detect User Activity Based Sandbox Evasion via reads of artifacts that reflect genuine human interaction with the host. (Retargeted: the previous rule checked /proc/scsi/scsi and /sys/class/dmi/id/, which are hardware/DMI System Checks -- T1497.001 -- not user-activity checks; this version instead watches for reads of shell history, browser history/profile databases, the recently-used-files list, and home-directory Desktop/Downloads paths, which is what T1497.002 actually describes.) Tune using: ArtifactCountThreshold, KnownToolSignatures.'
references:
  - https://attack.mitre.org/techniques/T1497/002
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.002

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_user_activity_artifacts:
    - type: PATH
      name|contains: '/.bash_history'
    - type: PATH
      name|contains: '/.local/share/recently-used.xbel'
    - type: PATH
      name|endswith: 'places.sqlite'
    - type: PATH
      name|endswith: 'History'
    - type: PATH
      name|contains: '/.viminfo'
    - type: PATH
      name|re: '/home/[^/]+/(Desktop|Downloads)/'

  condition: selection_user_activity_artifacts

falsepositives:
  - Legitimate hardware-inventory and desktop-search-indexing tools (tracker, baloo) as well as the user's own interactive shell reading .bash_history read the same paths for benign reasons; ArtifactCountThreshold aggregation across several distinct indicators in a short window is required to distinguish deliberate sandbox-evasion probing from routine single-file reads, which one PATH event alone cannot express.

level: low

T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks

title: "T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks"
id: ebacb74e-e850-46dc-9b16-98694633f3ab
description: 'Detect User Activity Based Sandbox Evasion via Input & Artifact Probing. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1497/002
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/osascript'
  selection_args:
    CommandLine|contains:
      - 'idle time'
      - 'System Events'
  condition: selection and selection_args

falsepositives:
  - Idle-time or mouse-movement checks used to detect the absence of a human operator require polling APIs such as CGEventSourceSecondsSinceLastEventType that are not surfaced as discrete unified log events, so this rule can only approximate detection through occasional AppleScript idle-time queries and will miss native API based checks entirely.

level: informational

Related sub-techniques

Explore