Techniques › T1614 › T1614.001
T1614.001 System Language Discovery
discovery — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
2
Sigma rules tagged attack.t1614.001
0
KEV CVEs mapped here
<p>Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.</p><p>There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.</p><p>For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.</p><p>On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0565 Detection Strategy for System Language Discovery v1.0
AN1561 WindowsRegistry access to system language keys (e.g., HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language) or suspicious processes invoking locale-related APIs (e.g., GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList). Defender visibility focuses on anomalous or non-standard processes issuing these queries, especially when run by unknown binaries or scripts.ETW
Calls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList→ DC0021 OS API ExecutionTunable:ParentProcessAllowListQueryThresholdAN1562 LinuxProcesses executing commands to query system locale and language settings, such as 'locale', 'echo $LANG', or parsing environment variables. Suspicious activity is indicated by these commands being run by unusual users, automation scripts, or non-administrative processes.auditd:SYSCALLexecve calls to /usr/bin/locale or shell execution of $LANG→ DC0064 Command ExecutionTunable:UserContextAN1563 macOSExecution of commands to query system locale and language settings, such as 'defaults read -g AppleLocale' or 'systemsetup -gettimezone'. Unusual parent processes or execution contexts of these commands may indicate adversarial discovery.macos:unifiedlogdefaults read -g AppleLocale or systemsetup -gettimezone→ DC0064 Command ExecutionTunable:ExecutionPath
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1614.001
Author: _pete_0, TheDFIRReport
· 2022-02-21 (modified 2024-03-05) · logsource: product=windows category=process_creation · 7090adee-82e2-4269-bd59-80691e7c6338
Detects use of chcp to look up the system locale value as part of host discovery
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-01-09 · logsource: product=windows category=process_creation · c43a5405-e8e1-4221-9ac9-dbe3fa14e886
Detects the usage of Reg.Exe to query system language settings.
Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
or avoid targeting certain locales to evade detection.