AN1182
Analytic 1182
Windows
Process execution that probes user activity artifacts (e.g., desktop files, registry history) following recent user login/unlock events.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=10
WinEventLog:Security
EventCode=4800, 4801
[TimeWindow]
Window between user unlock and access to user history
[UserContext]
Focus on non-system accounts doing user activity probing
AN1183
Analytic 1183
Linux
Access to shell history or GUI input state (xdotool, xinput) for presence validation prior to payload execution.
auditd:SYSCALL
Reads of ~/.bash_history, ~/.mozilla, or access to /dev/input
auditd:SYSCALL
Execution of xev, xdotool, or input activity emulators
[ArtifactCountThreshold]
Number of distinct user files accessed before trigger
[KnownToolSignatures]
Suppress expected automation tools
AN1184
Analytic 1184
macOS
API usage or filesystem access revealing user state or browser artifacts (e.g., Safari bookmarks, CGEventState).
macos:unifiedlog
Execution of input detection APIs (e.g., CGEventSourceKeyState)
macos:unifiedlog
Access to ~/Library/Safari/Bookmarks.plist or recent files
[TimeWindow]
Temporal correlation between login and file access
[UserContext]
Exclude expected UI activity from login agents