Cross-source coverage
T1614.001 / ATT&CK
System Location Discovery: System Language Discovery
6 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.
There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.
For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.
On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.
- Tactics
- Discovery
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonETWauditd:SYSCALLlinux:Sysmonmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0565
Detection Strategy for System Language Discovery
Windows Analytic 1561
Registry access to system language keys (e.g., HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language) or suspicious processes invoking locale-related APIs (e.g., GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList). Defender visibility focuses on anomalous or non-standard processes issuing these queries, especially when run by unknown binaries or scripts.
WinEventLog:SecurityEventCode=4657WinEventLog:SysmonEventCode=1ETWCalls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList
Linux Analytic 1562
Processes executing commands to query system locale and language settings, such as 'locale', 'echo $LANG', or parsing environment variables. Suspicious activity is indicated by these commands being run by unusual users, automation scripts, or non-administrative processes.
auditd:SYSCALLexecve calls to /usr/bin/locale or shell execution of $LANGlinux:SysmonEventCode=1
macOS Analytic 1563
Execution of commands to query system locale and language settings, such as 'defaults read -g AppleLocale' or 'systemsetup -gettimezone'. Unusual parent processes or execution contexts of these commands may indicate adversarial discovery.
macos:unifiedlogdefaults read -g AppleLocale or systemsetup -gettimezonemacos:osqueryexecve
socfortress/Wazuh-Rules
4 rules| Detection | Severity | Format |
|---|---|---|
| System language discovery attempt via environment variable query (env or printenv). | Medium | Wazuh XML |
| System locale command executed via localectl (Possible reconnaissance) | Medium | Wazuh XML |
| System locale configuration file accessed (T1614.001 - System Language Discovery) | Medium | Wazuh XML |
| System location discovery using locale command (T1614) | Medium | Wazuh XML |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Console CodePage Lookup Via CHCP | Medium | Sigma |
| System Language Discovery via Reg.Exe | Medium | Sigma |