System Language Discovery T1614.001

Identify System language by querying the registry on an endpoint. Upon successful execution, result in number format can be looked up to correlate the language.

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language

Identify System language with the chcp command. Upon successful execution, result in number format can be looked up to correlate the language.

chcp

Identify System language with the locale command. Upon successful execution, the output will contain the environment variables that indicate the 5 character locale that can be looked up to correlate the language and territory.

locale

Identify System language with the localectl command. Upon successful execution, the key System Locale from the output will contain the LANG environment variable that has the 5 character locale result that can be looked up to correlate the language and territory.

localectl status

Identify System language with the by reading the locale configuration file. The locale configuration file contains the LANG environment variable which will contain the 5 character locale that can be looked up to correlate the language and territory.

[ -f /etc/locale.conf ] && cat /etc/locale.conf || cat /etc/default/locale

[ -f /etc/locale.conf ] || [ -f /etc/default/locale ] && exit 0 || exit 1

echo "Test only valid for systems that have locale file"

Identify System language by checking the environment variables Upon successful execution, the 5 character locale result can be looked up to correlate the language and territory. Environment query commands are likely to run with a pattern match command e.g. env | grep LANG Note: env and printenv will usually provide the same results. set is also used as a builtin command that does not generate syscall telemetry but does provide a list of the environment variables.

env | grep LANG
printenv LANG
set | grep LANG

[ -x "$(command -v printenv)" ] && exit 0 || exit 1

echo "printenv command does not exist"
exit 1

The Windows utility DISM (Deployment Image Servicing and Management) can be used to display information about international settings and languages on the currently installed Windows image using an elevated terminal.

dism.exe /online /Get-Intl

This test executes a custom script called LanguageKeyboardLayout.exe which outputs the values of the following Windows API functions to the user terminal: GetKeyboardLayout, GetKeyboardLayoutList, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetUserDefaultLangID. Documentation for these functions is located here.

PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe") {exit 0} else {exit 1}

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe") -ErrorAction Ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1614.001/bin/LanguageKeyboardLayout.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe"

WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a simplified interface to query and manage Windows system configurations, processes, and hardware information using WMI. The command in this test retrieves information about the system's locale, operating system language, and multilingual user interface (MUI) languages.

wmic /node:#{target_host} os get Locale,OSLanguage,MUILanguages /format:#{format_style}

This PowerShell script collects key system settings, such as the UI language, user language preferences, system locale, current culture, UI culture, and time zone, into a hash table. It then outputs these settings in a readable key-value format directly to the terminal. The script is simple and efficient for quickly displaying system configuration details.

$info = @{
  UILanguage     = Get-WinUILanguageOverride
  UserLanguages  = (Get-WinUserLanguageList).LanguageTag -join ', '
  SystemLocale   = Get-WinSystemLocale
  CurrentCulture = [System.Globalization.CultureInfo]::CurrentCulture.Name
  CurrentUICulture = [System.Globalization.CultureInfo]::CurrentUICulture.Name
  TimeZone       = (Get-TimeZone).Id
}
$info.GetEnumerator() | ForEach-Object { "$($_.Name): $($_.Value)" }