Picus Security Explains MITRE ATT&CK Technique T1497.002

Cybersecurity firm Picus Security has released an in-depth analysis of the T1497.002 User Activity-Based Checks technique, part of the MITRE ATT&CK framework. This technique allows malware to detect whether it is running in a live user environment or within an analysis tool, such as a sandbox or virtual machine.

Picus Security notes that malware employs various methods to identify analysis environments. These include inspecting user directories like Desktop or Documents for files, checking browser history and cache, and monitoring real-time user interactions such as mouse movements and clicks. Analyzing process counts and network activity can also reveal the environment's nature.

Despite not appearing in the top ten techniques previously, T1497.002 re-emerged in the Red Report 2026 as one of the most commonly used. The report highlights an example with the LummaC2 malware, which delays payload activation until it detects a specific pattern of user activity. This involves detecting and analyzing mouse movements using trigonometry to confirm human-like behavior.

Upon detecting a sandbox or analysis environment, the malware remains dormant to avoid exposure. This allows attackers to bypass security measures and increase the likelihood of successful execution in a real-world setting. Picus Security's analysis underscores the need to understand and defend against such advanced evasion tactics.