T1614 / ATT&CK

Windows Analytic 0119

Unusual process or API usage attempting to query system locale, timezone, or keyboard layout (e.g., calls to GetLocaleInfoW, GetTimeZoneInformation). Detection can be enhanced by correlating with processes not typically associated with system configuration queries, such as unknown binaries or scripts.

• WinEventLog:Security EventCode=4688
• etw:Microsoft-Windows-Kernel-Base GetLocaleInfoW, GetTimeZoneInformation API calls

Linux Analytic 0120

Detection of commands accessing locale, timezone, or language settings such as 'locale', 'timedatectl', or parsing /etc/timezone. Anomalous execution by unusual users or automation scripts should be flagged.

• auditd:SYSCALL execve calls to locale, timedatectl, or cat /etc/timezone
• linux:Sysmon EventCode=1

macOS Analytic 0121

Detection of system calls or commands accessing system locale (e.g., 'defaults read -g AppleLocale', 'systemsetup -gettimezone'). Correlate with unusual parent processes or execution contexts.

• macos:unifiedlog defaults read -g AppleLocale, systemsetup -gettimezone
• macos:osquery execve

IaaS Analytic 0122

Detection of queries to instance metadata services (e.g., AWS IMDS, Azure Metadata Service) for availability zone, region, or network geolocation details. Correlation with non-management accounts or non-standard workloads may indicate adversary reconnaissance.

• AWS:CloudTrail GetMetadata, DescribeInstanceIdentity
• azure:vpcflow HTTP requests to 169.254.169.254 or Azure Metadata endpoints