Registry access to system language keys (e.g., HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language) or suspicious processes invoking locale-related APIs (e.g., GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList). Defender visibility focuses on anomalous or non-standard processes issuing these queries, especially when run by unknown binaries or scripts.
| Data Component | Name | Channel |
|---|---|---|
| Windows Registry Key Access (DC0050) | WinEventLog:Security | EventCode=4657 |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| OS API Execution (DC0021) | ETW | Calls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList |
| Field | Description |
|---|---|
| ParentProcessAllowList | Defines trusted processes allowed to query registry language keys or APIs. Unexpected parent-child process chains may indicate adversary use. |
| QueryThreshold | Frequency threshold for language registry or API calls within a set time window. |
Processes executing commands to query system locale and language settings, such as 'locale', 'echo $LANG', or parsing environment variables. Suspicious activity is indicated by these commands being run by unusual users, automation scripts, or non-administrative processes.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | execve calls to /usr/bin/locale or shell execution of $LANG |
| Process Creation (DC0032) | linux:Sysmon | EventCode=1 |
| Field | Description |
|---|---|
| UserContext | Unexpected or non-admin users executing locale commands may suggest malicious behavior. |
Execution of commands to query system locale and language settings, such as 'defaults read -g AppleLocale' or 'systemsetup -gettimezone'. Unusual parent processes or execution contexts of these commands may indicate adversarial discovery.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | defaults read -g AppleLocale or systemsetup -gettimezone |
| Process Creation (DC0032) | macos:osquery | execve |
| Field | Description |
|---|---|
| ExecutionPath | Restrict or monitor processes outside of system utilities that query AppleLocale or system language settings. |