What MITRE ATT&CK T1497.002: User Activity Based Checks (Enterprise Tactic TA0005 - Defense Evasion / TA0007 - Discovery) requires
MITRE ATT&CK T1497.002 (User Activity Based Checks) is an Enterprise Defense Evasion and Discovery sub-technique of T1497 (Virtualization/Sandbox Evasion). Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Affected platforms: Linux, macOS, Windows.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1497/002/
SHA-256 integrity: e20a0f13929c944a5caa19a9247b5ad06de8878c712e7ffc109d062f57e3d2be
Primary Citations — 5 traced to source
- MITRE ATT&CK Technique T1497.002: User Activity Based Checks (https://attack.mitre.org/techniques/T1497/002/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 3 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1497-002-user-activity-based-checks.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1497-002-user-activity-based-checks.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1497-002-user-activity-based-checks
- Back to registry: Browse all 10,085 compliance nodes