T1614.001: System Language Discovery
Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.[1]
There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.[2]
For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.[3][4][5]
On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.
Analyst context for executives and security teams
System Language Discovery is a small discovery behavior with outsized decision value: malware or operators may check a host’s language, locale, or keyboard settings to infer geography and decide what to do next. For leaders, this matters because it can be part of automated targeting logic before ransomware, banking malware, backdoors, or espionage activity proceeds. By itself it is not proof of compromise, but in the right sequence it can help explain why suspicious code is profiling an endpoint before follow-on actions.
Executive priority
Prioritize this as a coverage-validation item rather than a standalone high-severity alert. ATT&CK associates this technique with multiple Windows malware families, including ransomware and backdoors, and with campaigns/groups, so it is useful for incident scoping, threat-informed detection engineering, and audit evidence that discovery behaviors are monitored. Ask whether SOC telemetry can show when endpoints query language/locale data, whether this is correlated with other discovery or execution activity, and whether incident responders can distinguish normal software localization checks from suspicious pre-infection gating.
Technical view
This is a Discovery sub-technique of System Location Discovery covering Linux, macOS, and Windows. On Windows, ATT&CK describes registry queries to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and use of APIs such as GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList, and GetUserDefaultLangID. On macOS and Linux, ATT&CK describes querying locale to retrieve $LANG. No official MITRE detection text is provided, but the relationship context includes DET0565, Detection Strategy for System Language Discovery. SOC teams should validate detections around abnormal locale/language checks when they occur near suspicious execution, malware staging, broader host discovery, or activity linked to known software relationships such as Ryuk, SynAck, Maze, REvil, IcedID, Bazar, Clop, Cuba, and related backdoors listed by ATT&CK.
Likely telemetry
- Windows process execution and command-line telemetry for tools or scripts querying locale, language, keyboard layout, or registry language keys.
- Windows registry access telemetry for HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language.
- Endpoint/EDR telemetry that can expose calls or behavioral indicators related to language and keyboard layout API usage where available.
- Linux and macOS process execution telemetry for locale commands and environment-variable inspection involving $LANG.
- Parent/child process context showing whether language discovery occurred from expected software installers/localized applications or from unusual binaries, scripts, downloaders, or backdoors.
Detection direction
- Do not alert on language checks in isolation without context; many legitimate applications check locale for localization.
- Tune for suspicious parent processes, newly introduced binaries, scripts, malware-like execution chains, or language checks occurring immediately before other discovery, persistence, credential, or impact behaviors.
- Validate DET0565 or equivalent internal analytics against the specific data sources available in the environment, because ATT&CK does not provide official detection logic for this object.
- Create platform-specific coverage: registry/API-oriented monitoring for Windows and process/environment monitoring for Linux and macOS.
- Use relationship context to enrich investigations, not to assert attribution: ATT&CK links this behavior to multiple groups, campaigns, and software families, but local evidence is required before drawing conclusions.
Mitigation priorities
- Focus first on visibility and correlation rather than blocking all locale checks, since language discovery is commonly legitimate.
- Ensure endpoint logging captures process lineage, command line, registry access where appropriate, and sufficient EDR behavioral context across Windows, Linux, and macOS.
- Use least privilege, application control, and execution-control baselines to reduce the chance that untrusted binaries or scripts can run discovery logic unchecked.
- In incident response playbooks, treat unexpected language discovery as a profiling signal and pivot to surrounding execution, persistence, network, and follow-on discovery evidence.
- For compliance and readiness evidence, document how discovery behaviors are logged, retained, triaged, and correlated with broader ATT&CK-based detections.
Analyst notes and limits
This technique is most valuable as a contextual signal. Its business relevance comes from helping identify malware or operator decision logic that may precede infection, selective execution, or additional actions. The supplied relationships show use by multiple ATT&CK-tracked campaigns, groups, and software entries, including ransomware and backdoor families, but those relationships should guide enrichment and prioritization rather than attribution.
Official MITRE detection guidance is not provided for this technique. The ATT&CK object supplies behavior examples and platform scope, but not specific analytics, data source requirements, severity, or mitigation text. Local telemetry quality, process context, baselines for legitimate localization behavior, and correlation with other events are required to assess risk accurately.
System Language Discovery
Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.[1]
There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.[2]
For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.[3][4][5]
On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1614 | System Location Discovery | This object subtechnique of System Location Discovery. |
Groups, software, and campaigns
G0004: Ke3chang
G1054: MirrorFace
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]
G1043: BlackByte
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]
G1053: Storm-0501
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.[1][2][3][4]
G1026: Malteiro
Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).[1]
S1153: Cuckoo Stealer
Cuckoo Stealer is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. Cuckoo Stealer is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.[1][2]
S0652: MarkiRAT
MarkiRAT is a remote access Trojan (RAT) compiled with Visual Studio that has been used by Ferocious Kitten since at least 2015.[1]
S0658: XCSSET
XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.[1][2][3]
S0625: Cuba
S0696: Flagpro
S0483: IcedID
S0640: Avaddon
S0449: Maze
S1122: Mispadu
Mispadu is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Service (MaaS) business model.[1][2] This malware is operated, managed, and sold by the Malteiro cybercriminal group.[2] Mispadu has mainly been used to target victims in Brazil and Mexico, and has also had confirmed operations throughout Latin America and Europe.[2][3][4]
S0543: Spark
S1228: PUBLOAD
PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.[1] PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.[2]
S0446: Ryuk
C0022: Operation Dream Job
Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.[1][2][3][4]
C0061: Operation Digital Eye
Operation Digital Eye was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. Operation Digital Eye activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 8c3b7719d5bd… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Malware System Language Check
Pierre-Marc Bureau. (2009, January 15). Malware Trying to Avoid Some Countries. Retrieved August 18, 2021.
Open source URL -
[2]
CrowdStrike Ryuk January 2019
Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
Open source URL -
[3]
Darkside Ransomware Cybereason
Cybereason Nocturnus. (2021, April 1). Cybereason vs. Darkside Ransomware. Retrieved August 18, 2021.
Open source URL -
[4]
Securelist JSWorm
Fedor Sinitsyn. (2021, May 25). Evolution of JSWorm Ransomware. Retrieved August 18, 2021.
Open source URL -
[5]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL -
[6]
mitre-attack T1614.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.