T1497.002, User Activity Based Checks, covers malware that looks for signs of a human before it runs. It applies to Linux, macOS and Windows and falls under stealth and discovery.
How attackers use it
Adversaries may search for user activity on the host. MITRE lists the speed and frequency of mouse movements and clicks, browser history, cache, bookmarks, and the number of files in common directories such as the home folder or desktop. Others rely on specific user interaction before the code activates, such as waiting for a document to close before a macro runs, or waiting for a double click on an embedded image.
MITRE's examples include malware that repeatedly checks the mouse cursor position, a loader that runs its payload only after the left mouse button has been pressed at least three times, phishing lures with embedded images that run the payload only after a double click, and a loader that calls GetForegroundWindow twice and compares handles.
How to detect it
MITRE describes three analytics.
- Windows: process executions that check user activity artifacts, such as desktop files or registry history, shortly after a login or unlock.
- Linux: access to shell history or GUI input state, with tools such as xdotool or xinput, to check for a user before a payload runs.
- macOS: API calls or file access that reveal user state or browser artifacts, such as Safari bookmarks or CGEventState.
MITRE names no log sources. Process execution, command and input state queries, and API or file access telemetry are the useful data.
How to reduce the risk
MITRE says prevention is difficult. In analysis environments, generate realistic activity: mouse movement, clicks, populated browser history and a believable desktop. Document lures need interaction, so automate opening, scrolling and closing. And keep endpoint detection on, because a sample that waited for a human on a real endpoint will get one.
Quick check
Why would malware wait for several mouse clicks?
Sandboxes often have no real user, so waiting for clicks helps it avoid running in analysis.
