T1614 System Location Discovery: Detection, Mitigation and Response

Much malware checks where a machine is before deciding whether to infect it, and that check leaves behaviour defenders can detect and intelligence responders can use. MITRE ATT&CK T1614 System Location Discovery covers adversaries trying to work out the geographical location of a victim host from settings such as time zone, keyboard layout and language, from Windows API calls, from IP geolocation, or in cloud environments from the instance metadata service. It sits in the Discovery tactic (TA0007), applies to Windows, Linux, macOS and IaaS, and has one sub-technique in ATT&CK v20: T1614.001 System Language Discovery. This guide covers how the technique is used, the language and keyboard checks malware uses to avoid Commonwealth of Independent States (CIS) systems and what they tell responders, the detection analytics ATT&CK publishes, and how to tune them against legitimate locale queries. It is for detection engineers, threat hunters and incident responders. The wider discovery picture is in the Discovery and Reconnaissance Techniques Guide.

Key takeaways

• Location checks shape the rest of the attack. ATT&CK describes adversaries using location to decide whether to fully infect a host or attempt specific actions, so a locale query early in a process's life is a decision point, not noise.
• The single query is benign; the sequence is not. Many legitimate programs read locale and time zone. Detection works when locale checks come from unknown binaries or scripts and sit inside a burst of discovery before payload activity.
• CIS exclusion checks are a fingerprint. ATT&CK records Ryuk, REvil, LockBit 2.0 and 3.0, Clop, DEATHRANSOM and others checking for Russian or other CIS languages and exiting if found. Seeing that logic in a sample narrows the family and the likely operator ecosystem.
• There is no preventive mitigation. ATT&CK v20 lists no mitigations for T1614 or T1614.001; locale information is a normal part of the operating system. Defence is detection and response.
• Cloud location discovery runs through metadata. ATT&CK's IaaS analytic watches for unusual queries to instance metadata services for region and availability zone, which overlaps with credential theft from the same endpoint.

How location discovery works

ATT&CK groups the methods into system settings, API calls and network lookups. The table summarises what ATT&CK's description and procedure examples record, at the level needed to write detection logic.

Microsoft's documentation for GetKeyboardLayoutList explains that it returns the input locale identifiers set up on the system, which is why malware uses it to see every installed layout rather than only the active one.

Keyboard layout and geo checks that avoid CIS victims

A long list of ransomware and crimeware in ATT&CK checks for Russian or other CIS languages and stops if one is found. Examples recorded in ATT&CK v20:

• Ryuk: reads InstallLanguage under the Nls\Language registry key and compares it with 0x419 (Russian), 0x422 (Ukrainian) and 0x423 (Belarusian).
• Ragnar Locker: checks GetLocaleInfoW and does not encrypt files if it finds a former Soviet country, as reported by the FBI.
• LockBit 3.0: CISA advisory AA23-075A states that languages on its exclusion list include, but are not limited to, Romanian (Moldova), Arabic (Syria) and Tatar (Russia), that it stops if one is detected, and that whether the check runs depends on a configuration flag set at compile time.
• SynAck: lists all installed keyboard layouts, and on a match sleeps for 300 seconds and exits without encrypting.
• Zeus Panda and DEATHRANSOM: exit on Russian, Belarusian, Kazakh, Ukrainian and, for DEATHRANSOM, Tatar layouts or language IDs.
• Storm-0501 (G1053): identifies system language codes to avoid victims associated with Russia and other CIS countries.
• Developer supply chain malware: GlassWorm checks for Russian language settings and a Russian-associated time zone, and Mini Shai-Hulud terminates when the system is configured for Russian. The Mini Shai-Hulud 2026 SAP npm packages analysis notes the payload quit on Russian-language systems and also checked whether it was running in CI.

The opposite pattern also exists: allow-list checks that run only in the intended region. ATT&CK records Mispadu terminating unless the language is Spanish or Portuguese, Spark and DropBook looking for Arabic, Operation Dream Job malware refusing to run on Korean, Japanese or Chinese systems, and CanisterWorm looking for an Iranian locale and time zone before deploying a wiper.

What it tells responders

• Family and ecosystem: a CIS exclusion list in a ransomware sample is consistent with many Russian-speaking criminal operations. It supports, but never proves, attribution; ATT&CK and government advisories record the behaviour, not the motive.
• Targeting intent: an allow list for one language or region shows the operation is aimed at that population, which matters for sector and regional intelligence sharing.
• Unaffected hosts: in an incident, hosts that match an exclusion may hold the malware without encryption. Do not treat them as clean: image them, because the binary is present and the intrusion reached them.
• Sandbox configuration: analysis environments configured with a CIS locale may see samples exit early. Detonate in a locale that matches your estate as well as a neutral one.

Location checks are a form of target validation. ATT&CK models the related guardrail behaviour separately in the MITRE ATT&CK T1480 Execution Guardrails, and checks for analysis environments in the MITRE ATT&CK T1497 Virtualization/Sandbox Evasion.

What to detect and where

ATT&CK v20 publishes DET0043 for T1614 and DET0565 for T1614.001. The analytics and the log sources they name are below.

Making it work in practice

• Correlate, do not alert on single queries: raise priority when a locale or keyboard query is followed within a short window (ATT&CK's tunable example is two minutes) by other discovery, such as T1082 System Information Discovery, T1124 System Time Discovery or T1016 System Network Configuration Discovery, and then by file encryption, credential access or outbound connections.
• Use the allow lists ATT&CK names as tunable: parent process allow lists on Windows, user context on Linux, execution path on macOS and a metadata query allow list for IaaS.
• Watch new and unsigned binaries: a process first seen today that calls keyboard layout APIs and then exits immediately is worth a look; it may have found a locale it was told to avoid.
• Look for geolocation lookups: outbound requests to IP geolocation services from servers, scripts or non-browser processes are rare in most estates and easy to baseline.
• Know your API telemetry limits: most EDR and Sysmon configurations do not log every API call; the process, registry and network context around the call is often what you can actually see.

For telemetry set-up see the EDR Guide and the Linux Logging and auditd for Defenders Guide.

Where identity fits

In cloud environments location discovery and credential theft share an endpoint. A workload that queries the instance metadata service for its region can query the same service for temporary role credentials (T1552.005 Cloud Instance Metadata API). Unusual metadata access from a container or process that does not normally need it should be triaged as possible credential access, not just discovery. Requiring session-based metadata access and limiting hop count reduces the risk; see the EC2 Instance Metadata Service Hardening Guide. In developer supply chain incidents such as Mini Shai-Hulud, the locale check sits in the same payload that harvests CI and cloud tokens, so a hit on that behaviour in a build runner should trigger rotation of the runner's credentials.

Mitigation and response

ATT&CK v20 lists no mitigations for T1614 or T1614.001. The following are NHI Mgmt Group recommendations aimed at the stages either side of the check.

1. Stop execution earlier: application control and script restrictions prevent the unknown binary or script from running at all, which is where location checks originate.
2. Harden metadata access: enforce session-based metadata services and restrict which workloads can reach them.
3. Triage the sequence: when an alert fires, pull the process tree, the discovery that came before and after, and network connections in the following minutes.
4. Analyse the sample: extract the locale lists and conditional branches; they help classify the family and show whether other hosts were spared or targeted.
5. Scope by locale: if your estate spans regions, check whether infection outcomes differ by host locale; hosts that were spared still need containment.
6. Share intelligence: include observed locale logic in reports to sector sharing groups, described as behaviour.

How to test

1. Benign emulation: in a test host, run a script from an unusual parent that reads locale, time zone and keyboard layouts, then performs other discovery. Confirm the correlation rule fires and the single-query rule stays quiet for normal software.
2. Cloud check: from a non-management workload in a test account, query the metadata service for region and confirm the IaaS analytic alerts.
3. False positive review: run the rules in alert-only mode for two weeks, list the legitimate processes (installers, browsers, office applications, management agents) and add them to the allow lists, documenting each exception.
4. Roll back: keep tuned versions under change control so a noisy rule can be returned to its previous version in one step.

Measuring it

• Coverage: share of Windows, Linux, macOS and cloud estates sending the log sources ATT&CK names for these analytics.
• Alert precision: share of correlated location-discovery alerts that triage confirms as malicious or suspicious.
• Time to triage: median minutes from alert to a decision.
• Metadata hygiene: share of cloud instances enforcing session-based metadata access.
• Emulation pass rate: share of quarterly emulation tests that produced the expected alert.

Common failure patterns

• Alerting on every locale query: browsers and office applications read locale constantly; single-event rules get disabled within a week.
• Treating spared hosts as clean: a host whose locale triggered an exit still ran attacker code.
• Sandbox locale mismatch: detonating in a locale that a sample avoids hides its behaviour from analysts.
• Ignoring build runners: CI and developer machines run install scripts that perform locale and CI checks; without telemetry there, the check and the token theft that follows go unseen.
• Over-reading attribution: a CIS exclusion list is shared across many families and affiliates, so it cannot name an actor on its own.

Framework mapping

Practitioner checklist

• Process creation, registry access and script logging are collected on Windows, with auditd or equivalent on Linux and unified log or osquery on macOS.
• Correlation rules link locale, time zone and keyboard queries with other discovery and follow-on activity.
• Allow lists for legitimate locale queries are documented and reviewed.
• Outbound requests to IP geolocation services from servers and scripts are baselined and alerted.
• Instance metadata access is session-based and monitored for unusual callers.
• Malware analysis runs in more than one locale.
• Incident playbooks treat hosts spared by a locale check as compromised.
• Build runners and developer machines send endpoint telemetry.

Standards and references

• MITRE ATT&CK: T1614 System Location Discovery
• MITRE ATT&CK: T1614.001 System Language Discovery
• MITRE ATT&CK: LockBit 3.0 (S1202)
• CISA: #StopRansomware: LockBit 3.0 (AA23-075A)
• Microsoft Learn: GetKeyboardLayoutList function
• MITRE ATT&CK: Ryuk (S0446)

Related NHI Mgmt Group resources: Discovery and Reconnaissance Techniques Guide, MITRE ATT&CK T1480 Execution Guardrails, Malware Analysis Guide for Defenders, LockBit Threat Actor Profile.