TA0005 · DEFENSE EVASION
User Activity Based Checks
Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.
Detect it with
User activity-based checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.
Why it matters on shift
User Activity Based Checks is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context