- AN1182 · Analytic 1182 — Process execution that probes user activity artifacts (e.g., desktop files, registry history) following recent user login/unlock events.
- AN1183 · Analytic 1183 — Access to shell history or GUI input state (xdotool, xinput) for presence validation prior to payload execution.
- AN1184 · Analytic 1184 — API usage or filesystem access revealing user state or browser artifacts (e.g., Safari bookmarks, CGEventState).
AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
User Activity Based Checks
Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors. Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro or waiting for a user to double click on an embedded image to activate.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
User activity-based checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Disk, file-system, and persistence forensics
Digital Forensics & Incident Response (DFIR) · Governed topic match · 63/100Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · Governed topic match · 51/100Linux and macOS endpoint forensics
Digital Forensics & Incident Response (DFIR) · Governed topic match · 51/100Packing, obfuscation, and anti-analysis
Malware Analysis & Reverse Engineering · Governed topic match · 42/100Incident declaration, triage, scope, and hypotheses
Digital Forensics & Incident Response (DFIR) · Governed topic match · 42/100Controlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · Tactic learning route · 24/100Internet exposure, service indexes, and infrastructure search
OSINT & Reconnaissance · Tactic learning route · 24/100Module 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · Tactic learning route · 24/100Data classification, storage, cryptography, keys, backup, and deletion
Cloud Security · Tactic learning route · 24/100
Digital Forensics & Incident Response (DFIR) · Governed topic match · 63/100Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · Governed topic match · 51/100Linux and macOS endpoint forensics
Digital Forensics & Incident Response (DFIR) · Governed topic match · 51/100Packing, obfuscation, and anti-analysis
Malware Analysis & Reverse Engineering · Governed topic match · 42/100Incident declaration, triage, scope, and hypotheses
Digital Forensics & Incident Response (DFIR) · Governed topic match · 42/100Controlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · Tactic learning route · 24/100Internet exposure, service indexes, and infrastructure search
OSINT & Reconnaissance · Tactic learning route · 24/100Module 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · Tactic learning route · 24/100Data classification, storage, cryptography, keys, backup, and deletion
Cloud Security · Tactic learning route · 24/100
MITRE mitigations
No ATT&CK mitigation relationship is published for this technique. Apply risk-based controls and verify scope.