System Language Discovery (T1614.001) is a Discovery sub-technique of System Location Discovery. MITRE lists Linux, Windows and macOS. Adversaries gather the system language of a victim to infer its geographic location and decide how to proceed.
MITRE says this can be used to reduce the risk of attracting the attention of certain law enforcement agencies or other scrutiny, which is why so many malware families skip machines with certain languages.
How attackers use it
Sources include system defaults and keyboard layouts. Specific checks vary, but may include Query Registry (T1012) and Native API calls (T1106).
On Windows, adversaries may query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or call GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID. On macOS or Linux, they may run locale to read the value of the LANG environment variable.
The page lists a long set of examples. A few: Clop checks the keyboard language with GetKeyboardLayout to avoid installing on Russian or other CIS language machines. IcedID ran cmd.exe with chcp to check the console country and language. LockBit 2.0 and 3.0 exit on systems whose language matches a list of mainly Eastern European languages. CanisterWorm checked the time zone for Asia/Tehran or Iran and the LANG variable for fa_IR before deploying a destructive wiper component. Cuckoo Stealer checked LANG to avoid infecting devices set to Armenia, Belarus, Kazakhstan, Russia and Ukraine.
How to detect it
MITRE's analytics, by platform:
- Windows: registry access to the system language keys, or suspicious processes calling locale related APIs such as GetUserDefaultUILanguage or GetKeyboardLayoutList. The signal is unknown binaries or scripts making these queries.
- Linux: processes running commands to read locale and language settings, such as locale or echo of the LANG variable, especially by unusual users, automation scripts or non administrative processes.
- macOS: commands such as defaults read for AppleLocale or systemsetup for the time zone, with unusual parent processes or execution contexts.
One of these queries alone means little. Together with a first-time executable, a script launched from an email attachment, or a process that also asks about the domain and security software, it forms a chain worth following.
How to reduce the risk
MITRE lists no mitigation. It is a normal use of system features. Focus on detection and on the stages around it. Sandboxes that run suspicious files can be set to common locales, so a sample that bails out on a mismatch behaves normally during analysis. That is general analyst practice rather than a MITRE recommendation.
Check your own environment
On Windows, start with process creation:
- Confirm process creation logging with command lines is on (Security Event ID 4688 with command line capture, or Sysmon Event ID 1).
- Search for cmd.exe running chcp, or reg query against the Nls Language key, from unusual parents.
Read-only example on Linux or macOS (shows what an attacker-style query returns on your own machine):
locale
echo "$LANG"
Quick check
Why do malware authors check language?
To decide whether to infect or act. MITRE says it may reduce the risk of attracting law enforcement or other scrutiny from specific regions.
Which Windows registry key does MITRE name?
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language.
