Try it using Invoke-Atomic

System Location Discovery: System Language Discovery

Description from ATT&CK

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check)

There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.(Citation: CrowdStrike Ryuk January 2019)

For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018)

On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.

Atomic Tests

Atomic Test #1 - Discover System Language by Registry Query

Identify System language by querying the registry on an endpoint.

Upon successful execution, result in number format can be looked up to correlate the language.

Supported Platforms: windows

auto_generated_guid: 631d4cf1-42c9-4209-8fe9-6bd4de9421be

Inputs:

None

Attack Commands: Run with command_prompt!

1
2

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language

Atomic Test #2 - Discover System Language with chcp

Identify System language with the chcp command.

Upon successful execution, result in number format can be looked up to correlate the language.

Supported Platforms: windows

auto_generated_guid: d91473ca-944e-477a-b484-0e80217cd789

Inputs:

None

Attack Commands: Run with command_prompt!

1
2

chcp

Atomic Test #3 - Discover System Language with locale

Identify System language with the 

1

locale
command.

Upon successful execution, the output will contain the environment variables that indicate the 5 character locale that can be looked up to correlate the language and territory.

Supported Platforms: freebsd,linux

auto_generated_guid: 837d609b-845e-4519-90ce-edc3b4b0e138

Inputs:

None

Attack Commands: Run with sh!

1
2

locale

Atomic Test #4 - Discover System Language with localectl

Identify System language with the 

1

localectl
command.

Upon successful execution, the key 

1

System Locale
from the output will contain the 
1

LANG
environment variable that has the 5 character locale result that can be looked up to correlate the language and territory.

Supported Platforms: linux

auto_generated_guid: 07ce871a-b3c3-44a3-97fa-a20118fdc7c9

Inputs:

None

Attack Commands: Run with sh!

1
2

localectl status

Atomic Test #5 - Discover System Language by locale file

Identify System language with the by reading the locale configuration file.

The locale configuration file contains the 

1

LANG
environment variable which will contain the 5 character locale that can be looked up to correlate the language and territory.

Supported Platforms: linux

auto_generated_guid: 5d7057c9-2c8a-4026-91dd-13b5584daa69

Inputs:

None

Attack Commands: Run with sh!

1
2

[ -f /etc/locale.conf ] && cat /etc/locale.conf || cat /etc/default/locale

Dependencies: Run with sh!

Description: Check the location of the locale configuration file.

Check Prereq Commands:

1
2

[ -f /etc/locale.conf ] || [ -f /etc/default/locale ] && exit 0 || exit 1

Get Prereq Commands:

1
2

echo "Test only valid for systems that have locale file"

Atomic Test #6 - Discover System Language by Environment Variable Query

Identify System language by checking the environment variables

Upon successful execution, the 5 character locale result can be looked up to correlate the language and territory. Environment query commands are likely to run with a pattern match command e.g. 

1

env | grep LANG

Note: 

1

env
and 
1

printenv
will usually provide the same results. 
1

set
is also used as a builtin command that does not generate syscall telemetry but does provide a list of the environment variables.

Supported Platforms: freebsd,linux

auto_generated_guid: cb8f7cdc-36c4-4ed0-befc-7ad7d24dfd7a

Inputs:

None

Attack Commands: Run with sh!

1
2
3
4

env | grep LANG
printenv LANG
set | grep LANG

Dependencies: Run with sh!

Description: Check if printenv command exists on the machine

Check Prereq Commands:

1
2

[ -x "$(command -v printenv)" ] && exit 0 || exit 1

Get Prereq Commands:

1
2
3

echo "printenv command does not exist"
exit 1

source