Unusual process or API usage attempting to query system locale, timezone, or keyboard layout (e.g., calls to GetLocaleInfoW, GetTimeZoneInformation). Detection can be enhanced by correlating with processes not typically associated with system configuration queries, such as unknown binaries or scripts.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| OS API Execution (DC0021) | etw:Microsoft-Windows-Kernel-Base | GetLocaleInfoW, GetTimeZoneInformation API calls |
| Field | Description |
|---|---|
| ParentProcessAllowList | Defines trusted processes expected to call locale APIs. Deviations may indicate adversarial activity. |
| TimeWindow | Specifies correlation window for API calls and suspicious process execution (e.g., 2m). |
Detection of commands accessing locale, timezone, or language settings such as 'locale', 'timedatectl', or parsing /etc/timezone. Anomalous execution by unusual users or automation scripts should be flagged.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | execve calls to locale, timedatectl, or cat /etc/timezone |
| Process Creation (DC0032) | linux:Sysmon | EventCode=1 |
| Field | Description |
|---|---|
| UserContext | Unexpected users running location discovery commands may indicate malicious behavior. |
Detection of system calls or commands accessing system locale (e.g., 'defaults read -g AppleLocale', 'systemsetup -gettimezone'). Correlate with unusual parent processes or execution contexts.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | defaults read -g AppleLocale, systemsetup -gettimezone |
| Process Creation (DC0032) | macos:osquery | execve |
| Field | Description |
|---|---|
| ExecutionPath | Restrict known binaries allowed to query system locale on macOS. |
Detection of queries to instance metadata services (e.g., AWS IMDS, Azure Metadata Service) for availability zone, region, or network geolocation details. Correlation with non-management accounts or non-standard workloads may indicate adversary reconnaissance.
| Data Component | Name | Channel |
|---|---|---|
| OS API Execution (DC0021) | AWS:CloudTrail | GetMetadata, DescribeInstanceIdentity |
| Network Traffic Content (DC0085) | azure:vpcflow | HTTP requests to 169.254.169.254 or Azure Metadata endpoints |
| Field | Description |
|---|---|
| MetadataQueryAllowList | Expected services that query cloud metadata APIs. Any additional sources may be malicious. |