tfMITRE ATT&CK technique

System Location Discovery T1614

Tactic: Discovery
Platforms: IaaS, Linux, macOS, Windows
Version: 1.1
Created: 01 April 2021
Last modified: 12 May 2026
Contributors: Pooja Natarajan, NEC Corporation India; Hiroki Nagahama, NEC Corporation; Manikantan Srinivasan, NEC Corporation India; Wes Hurd; Katie Nickels, Red Canary

Sub-techniques 12 rules across the family · 0 mapped directly to T1614 · 1 of 1 carry rules

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 46% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 14%

Tools & malware86th percentile · 86% of ATT&CK techniques have fewer tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

tfMITRE ATT&CK technique

System Location Discovery T1614

Tactic: Discovery
Platforms: IaaS, Linux, macOS, Windows
Version: 1.1
Created: 01 April 2021
Last modified: 12 May 2026
Contributors: Pooja Natarajan, NEC Corporation India; Hiroki Nagahama, NEC Corporation; Manikantan Srinivasan, NEC Corporation India; Wes Hurd; Katie Nickels, Red Canary

Sub-techniques 12 rules across the family · 0 mapped directly to T1614 · 1 of 1 carry rules

.001System Language Discovery2

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 46% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 14%

Tools & malware86th percentile · 86% of ATT&CK techniques have fewer tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

System Location Discovery MITRE reference T1614

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has obtained the victim's system current location.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

SideCopyG1008 ↗

Has identified the country location of a compromised host.1

created 2022-08-071 reference

All 2 groups for this technique

25 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has discovered the compromised systems location through a query of the system timezone configuration and the locale settings.1

created 2026-07-29MALWAREcarried by 1 group

Tsundere BotnetS9034 ↗

Has checked the victim machine’s location by obtaining the culture name of the machine.1

created 2026-04-20MALWAREcarried by 1 group

AshTagS9031 ↗

Can check geolocation on targeted systems.1

created 2026-04-20MALWAREcarried by 1 group

SameCoinS9030 ↗

Can attempt to connect to the Israel Home Front Command site, oref.org[.]il, which is only reachable from within Israel to verify the target's location.1

created 2026-04-20MALWAREcarried by 1 group

PureCrypterS9019 ↗

Can use kernel32!GetGeoInfo to determine system location.1

created 2026-04-16MALWAREcarried by 1 group

GlassWormS9010 ↗

Has leveraged geofencing logic to detect whether it is operating in a Russian associated time zone to determine whether it continues to execute.1

created 2026-04-10MALWARE

All 25 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Base	GetLocaleInfoW, GetTimeZoneInformation API calls
Process CreationDC0032	WinEventLog:Security	EventCode=4688

Data component

Name

Channel

OS API ExecutionDC0021

etw:Microsoft-Windows-Kernel-Base

GetLocaleInfoW, GetTimeZoneInformation API calls

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Field	What you tune
ParentProcessAllowList	Defines trusted processes expected to call locale APIs. Deviations may indicate adversarial activity.
TimeWindow	Specifies correlation window for API calls and suspicious process execution (e.g., 2m).

Field

What you tune

ParentProcessAllowList

Defines trusted processes expected to call locale APIs. Deviations may indicate adversarial activity.

TimeWindow

Specifies correlation window for API calls and suspicious process execution (e.g., 2m).

Data component	Name	Channel
Process CreationDC0032	linux:Sysmon	EventCode=1
Command ExecutionDC0064	auditd:SYSCALL	execve calls to locale, timedatectl, or cat /etc/timezone

Data component	Name	Channel
Process CreationDC0032	macos:osquery	execve
Command ExecutionDC0064	macos:unifiedlog	defaults read -g AppleLocale, systemsetup -gettimezone

Data component	Name	Channel
OS API ExecutionDC0021	AWS:CloudTrail	GetMetadata, DescribeInstanceIdentity
Network Traffic ContentDC0085	azure:vpcflow	HTTP requests to 169.254.169.254 or Azure Metadata endpoints

System Location Discovery T1614

System Location Discovery T1614

System Location Discovery MITRE reference T1614

System Location Discovery MITRE reference T1614

Offense vs defense T1614

System Location Discovery detection strategy DET0043

Detection Strategy for System Location Discovery

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

System Location Discovery detections T1614

System Location Discovery detections T1614