T1497.002sub-technique of T1497 Virtualization/Sandbox Evasion

User Activity Based Checks

Linux · macOS · Windowsnothing on this site yetT1497.002 on attack.mitre.org

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detect User Activity Based Sandbox Evasion via Input & Artifact Probing

Process execution that probes user activity artifacts (e.g., desktop files, registry history) following recent user login/unlock events.
Access to shell history or GUI input state (xdotool, xinput) for presence validation prior to payload execution.
API usage or filesystem access revealing user state or browser artifacts (e.g., Safari bookmarks, CGEventState).

the rest of T1497

T1497.001 System Checks · not covered yet
T1497.003 Time Based Checks · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.