Volt TyphoonG1017 ↗
Has obtained the victim's system current location.1
tfMITRE ATT&CK technique
System Location Discovery T1614
- Tactic
- Discovery
- Platforms
- IaaS, Linux, macOS, Windows
- Version
- 1.1
- Created
- 01 April 2021
- Last modified
- 12 May 2026
- Contributors
- Pooja Natarajan, NEC Corporation India; Hiroki Nagahama, NEC Corporation; Manikantan Srinivasan, NEC Corporation India; Wes Hurd; Katie Nickels, Red Canary
Sub-techniques 12 rules across the family · 0 mapped directly to T1614 · 1 of 1 carry rules
Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.25
Tools & malwareTop 14%
Tools & malware86th percentile · 86% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.System Location Discovery MITRE reference T1614
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 2 groups for this technique
25 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has discovered the compromised systems location through a query of the system timezone configuration and the locale settings.1
Tsundere BotnetS9034 ↗
Has checked the victim machine’s location by obtaining the culture name of the machine.1
AshTagS9031 ↗
Can check geolocation on targeted systems.1
SameCoinS9030 ↗
Can attempt to connect to the Israel Home Front Command site, oref.org[.]il, which is only reachable from within Israel to verify the target's location.1
PureCrypterS9019 ↗
Can use kernel32!GetGeoInfo to determine system location.1
GlassWormS9010 ↗
Has leveraged geofencing logic to detect whether it is operating in a Russian associated time zone to determine whether it continues to execute.1
All 25 software entries for this technique · 6 newest in this preview
Offense vs defense T1614
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
System Location Discovery detection strategy DET0043
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for System Location Discovery
4 platforms
AN0119 · Windows
Unusual process or API usage attempting to query system locale, timezone, or keyboard layout (e.g., calls to GetLocaleInfoW, GetTimeZoneInformation). Detection can be enhanced by correlating with processes not typically associated with system configuration queries, such as unknown binaries or scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | etw:Microsoft-Windows-Kernel-Base | GetLocaleInfoW, GetTimeZoneInformation API calls |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessAllowList | Defines trusted processes expected to call locale APIs. Deviations may indicate adversarial activity. |
| TimeWindow | Specifies correlation window for API calls and suspicious process execution (e.g., 2m). |
AN0120 · Linux
Detection of commands accessing locale, timezone, or language settings such as 'locale', 'timedatectl', or parsing /etc/timezone. Anomalous execution by unusual users or automation scripts should be flagged.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | linux:Sysmon | EventCode=1 |
| Command ExecutionDC0064 | auditd:SYSCALL | execve calls to locale, timedatectl, or cat /etc/timezone |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Unexpected users running location discovery commands may indicate malicious behavior. |
AN0121 · macOS
Detection of system calls or commands accessing system locale (e.g., 'defaults read -g AppleLocale', 'systemsetup -gettimezone'). Correlate with unusual parent processes or execution contexts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | execve |
| Command ExecutionDC0064 | macos:unifiedlog | defaults read -g AppleLocale, systemsetup -gettimezone |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutionPath | Restrict known binaries allowed to query system locale on macOS. |
AN0122 · IaaS
Detection of queries to instance metadata services (e.g., AWS IMDS, Azure Metadata Service) for availability zone, region, or network geolocation details. Correlation with non-management accounts or non-standard workloads may indicate adversary reconnaissance.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | AWS:CloudTrail | GetMetadata, DescribeInstanceIdentity |
| Network Traffic ContentDC0085 | azure:vpcflow | HTTP requests to 169.254.169.254 or Azure Metadata endpoints |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MetadataQueryAllowList | Expected services that query cloud metadata APIs. Any additional sources may be malicious. |
Tests2Executorscmd 1 · bash 1Need elevation0 of 2Have prerequisites1Have cleanup0Platformswindows, macos, linux
Tests from Atomic Red Team (MIT licence) · technique definition