Understanding System Location Discovery (T1614)

System Location Discovery (T1614) is a Discovery technique for Windows, Linux, macOS and IaaS. Adversaries gather information to work out where a victim host is in the world. It has one sub-technique, System Language Discovery.

The result often decides what happens next: whether to fully infect the machine, or to do nothing.

How attackers use it

MITRE says adversaries may infer location from system checks such as time zone, keyboard layout and language settings. On Windows, API functions such as GetLocaleInfoW can reveal the locale. In cloud environments, an instance's availability zone can be discovered by accessing the instance metadata service from the instance. Adversaries may also infer location from IP addressing, using online geolocation lookup services.

The page lists many malware examples. Some behaviors: Amadey does not run tasks or install more malware if the machine is based in Russia. Ragnar Locker checks GetLocaleInfoW and does not encrypt files if it finds a former Soviet country. Gootloader can use IP geolocation to decide whether a visitor to a compromised site is in a targeted territory such as the US, Canada, Germany or South Korea. InvisibleFerret collected IP geolocation data and sent it to a command server.

How to detect it

MITRE offers an analytic per platform:

• Windows: unusual processes or API use that query locale, time zone or keyboard layout, such as GetLocaleInfoW or GetTimeZoneInformation. Correlate with processes that do not normally query system configuration, such as unknown binaries or scripts.
• Linux: commands that access locale, time zone or language settings, such as locale, timedatectl, or reading the time zone file. Flag unusual users or automation scripts running them.
• macOS: commands such as defaults read for AppleLocale or systemsetup with the get time zone option, run from unusual parent processes.
• IaaS: queries to instance metadata services (AWS IMDS, Azure Metadata Service) for availability zone, region or network details, especially from non management accounts or non standard workloads.

How to reduce the risk

MITRE lists no mitigation for this technique. Location checks use normal system features, so blocking them is not realistic. The value is in detection and in the controls around the rest of the chain: if the payload runs only when a location test passes, a sandbox that spoofs the right locale can help analysts see what it would do.

Quick check

Sources

• MITRE ATT&CK T1614 System Location Discovery