Esc

System Language Discovery - T1614.001

(ATT&CK® Technique)

Definition

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1614001["System Language Discovery"] --> |queries| SystemConfigurationDatabase["System Configuration Database"]; class T1614001 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";
        click T1614001 href "/offensive-technique/attack/T1614.001/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";       T1614001["System Language Discovery"] --> |accesses| ConfigurationResource["Configuration Resource"]; class T1614001 OffensiveTechniqueNode;
        class ConfigurationResource ArtifactNode; click ConfigurationResource href "/dao/artifact/d3f:ConfigurationResource";
        click T1614001 href "/offensive-technique/attack/T1614.001/"; click ConfigurationResource href "/dao/artifact/d3f:ConfigurationResource";       SystemConfigurationPermissions["System Configuration Permissions"] -->
          | restricts | SystemConfigurationDatabase["System Configuration Database"];

          SystemConfigurationPermissions["System Configuration Permissions"] -.->
            | may-harden | T1614001["System Language Discovery"] ;
          class SystemConfigurationPermissions DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click SystemConfigurationPermissions href "/technique/d3f:SystemConfigurationPermissions";  RestoreDatabase["Restore Database"] -->
          | restores | SystemConfigurationDatabase["System Configuration Database"];

          RestoreDatabase["Restore Database"] -.->
            | may-restore | T1614001["System Language Discovery"] ;
          class RestoreDatabase DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click RestoreDatabase href "/technique/d3f:RestoreDatabase";                   RestoreConfiguration["Restore Configuration"] -->
          | restores | ConfigurationResource["Configuration Resource"];

          RestoreConfiguration["Restore Configuration"] -.->
            | may-restore | T1614001["System Language Discovery"] ;
          class RestoreConfiguration DefensiveTechniqueNode;
          class ConfigurationResource ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration";

json