Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0420 — Detect User Activity Based Sandbox Evasion via Input & Artifact Probing
DET0420

Detect User Activity Based Sandbox Evasion via Input & Artifact Probing

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1182 Analytic 1182
Windows

Process execution that probes user activity artifacts (e.g., desktop files, registry history) following recent user login/unlock events.

WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=10 WinEventLog:Security EventCode=4800, 4801
[TimeWindow] Window between user unlock and access to user history
[UserContext] Focus on non-system accounts doing user activity probing
AN1183 Analytic 1183
Linux

Access to shell history or GUI input state (xdotool, xinput) for presence validation prior to payload execution.

auditd:SYSCALL Reads of ~/.bash_history, ~/.mozilla, or access to /dev/input auditd:SYSCALL Execution of xev, xdotool, or input activity emulators
[ArtifactCountThreshold] Number of distinct user files accessed before trigger
[KnownToolSignatures] Suppress expected automation tools
AN1184 Analytic 1184
macOS

API usage or filesystem access revealing user state or browser artifacts (e.g., Safari bookmarks, CGEventState).

macos:unifiedlog Execution of input detection APIs (e.g., CGEventSourceKeyState) macos:unifiedlog Access to ~/Library/Safari/Bookmarks.plist or recent files
[TimeWindow] Temporal correlation between login and file access
[UserContext] Exclude expected UI activity from login agents

Detected Techniques

1

Details

MITRE ID
DET0420
STIX ID
x-mitre-detection-strategy--5463d676-c300-4ab8-9980-d3ed37ac4723
Analytics
3
Techniques Detected
1
By Tactic
Stealth
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.