MITRE ATT&CKtechnique

T1614 System Location Discovery

Published 2021-04-01 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
IaaS, Linux, macOS, Windows
Version
1.1
Created
2021-04-01

Description

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · subtechnique of (1)

  • T1614.001 System Language Discovery sub-technique

Referenced by MITRE ATT&CK · uses (28)

  • S9050 Vidar software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9030 SameCoin software (malware)
  • S9031 AshTag software (malware)
  • S9034 Tsundere Botnet software (malware)
  • S9019 PureCrypter software (malware)
  • S9010 GlassWorm software (malware)
  • S1248 XORIndex Loader software (malware)
  • S1249 HexEval Loader software (malware)
  • S1245 InvisibleFerret software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1153 Cuckoo Stealer software (malware)
  • S1148 Raccoon Stealer software (malware)
  • S1138 Gootloader software (malware)
  • S1124 SocGholish software (malware)
  • S1111 DarkGate software (malware)
  • G1017 Volt Typhoon group
  • G1008 SideCopy group
  • S1025 Amadey software (malware)
  • S1018 Saint Bot software (malware)
  • S0673 DarkWatchman software (malware)
  • S0632 GrimAgent software (malware)
  • S0481 Ragnar Locker software (malware)
  • S0461 SDBbot software (malware)
  • S0332 Remcos software (tool)
  • S0262 QuasarRAT software (tool)
  • S0013 PlugX software (malware)
  • S0115 Crimson software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-694 System Location Discovery attack pattern

References