T1614.001 — System Language Discovery

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This…

Sub-technique of System Location Discovery (T1614).

Sigma detection rules (3)

T1614.001 System Location Discovery: System Language Discovery

title: "T1614.001 System Location Discovery: System Language Discovery"
id: 91e7e6c2-c883-46ca-a1f5-ec5e7aa932ca
description: 'Detection Strategy for System Language Discovery. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcessAllowList, QueryThreshold.'
references:
  - https://attack.mitre.org/techniques/T1614/001
author: Shahrukh Khan
date: 2026-06-02
license: MIT
tags:
  - attack.discovery
  - attack.t1614.001

logsource:
  product: windows

detection:
  selection:
    EventID: '1'

  selection_language_discovery_cmds:
    CommandLine|contains:
      - 'Get-WinSystemLocale'
      - 'Get-Culture'
      - 'Get-UICulture'
      - 'Nls\Language'
      - 'GetUserDefaultUILanguage'
      - 'GetSystemDefaultUILanguage'
      - '[System.Globalization.CultureInfo]'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_language_discovery_cmds and not filter_system_account

falsepositives:
  - Localization/QA test scripts or IT tooling that legitimately enumerate system language/culture settings.

level: medium

T1614.001 System Location Discovery: System Language Discovery

title: "T1614.001 System Location Discovery: System Language Discovery"
id: 695d1b0c-fd93-4738-831c-7dbf566cbaf6
description: 'Detection Strategy for System Language Discovery. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) The env-check sub-selection matched a1 for "echo $LANG", but a standard `bash -c "echo $LANG"` invocation puts the -c flag in a1 and the quoted command text in a2, so the prior pattern would essentially never match real telemetry. Corrected to match a1 == -c and a2 containing the echo $LANG text. Tune using: UserContext.'
references:
  - https://attack.mitre.org/techniques/T1614/001
author: Shahrukh Khan
date: 2026-02-07
license: MIT
tags:
  - attack.discovery
  - attack.t1614.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/locale'
  selection_env:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
    a2|contains: 'echo $LANG'

  condition: 1 of selection*

falsepositives:
  - locale is invoked constantly by shell login scripts, terminal multiplexers, and applications for entirely benign reasons — extremely high baseline noise expected.

level: informational

T1614.001 System Location Discovery: System Language Discovery

title: "T1614.001 System Location Discovery: System Language Discovery"
id: 311cb34c-3926-453a-97fb-89b711e94ea2
description: 'Detection Strategy for System Language Discovery. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionPath.'
references:
  - https://attack.mitre.org/techniques/T1614/001
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.discovery
  - attack.t1614.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/defaults'
    CommandLine|contains:
      - 'AppleLocale'
      - 'AppleLanguages'

  condition: selection

falsepositives:
  - Localization-aware applications and installers routinely query the system language during normal startup.

level: informational

Explore