| ID | Name |
|---|---|
| T1614.001 | System Language Discovery |
Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.[1][2][3] Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.[1] In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.[4][5]
Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.[6][2]
| ID | Name | Description |
|---|---|---|
| S0115 | Crimson |
Crimson can identify the geographical location of a victim host.[7] |
| S0632 | GrimAgent |
GrimAgent can identify the country code on a compromised host.[8] |
| S0481 | Ragnar Locker |
Before executing malicious code, Ragnar Locker checks the Windows API |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component |
|---|---|---|
| DS0017 | Command | Command Execution |
| DS0030 | Instance | Instance Metadata |
| DS0009 | Process | OS API Execution |
| Process Creation |
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system location information. Remote access tools with built-in features may interact directly with the Windows API, such as calling GetLocaleInfoW to gather information.[1]
Monitor traffic flows to geo-location service provider sites, such as ip-api and ipinfo.