System Location Discovery

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.[1][2][3] Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.[1] In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.[4][5]

Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.[6][2]

ID: T1614
Sub-techniques:  T1614.001
Tactic: Discovery
Platforms: IaaS, Linux, Windows, macOS
Permissions Required: User
Contributors: Hiroki Nagahama, NEC Corporation; Katie Nickels, Red Canary; Manikantan Srinivasan, NEC Corporation India; Pooja Natarajan, NEC Corporation India; Wes Hurd
Version: 1.0
Created: 01 April 2021
Last Modified: 15 October 2021

Procedure Examples

ID Name Description
S1025 Amadey

Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.[7]

S0115 Crimson

Crimson can identify the geographical location of a victim host.[8]

S1111 DarkGate

DarkGate queries system locale information during execution.[9] Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.[10]

S0673 DarkWatchman

DarkWatchman can identity the OS locale of a compromised host.[11]

S0632 GrimAgent

GrimAgent can identify the country code on a compromised host.[12]

S0262 QuasarRAT

QuasarRAT can determine the country a victim host is located in.[13]

S0481 Ragnar Locker

Before executing malicious code, Ragnar Locker checks the Windows API GetLocaleInfoW and doesn't encrypt files if it finds a former Soviet country.[1]

S1018 Saint Bot

Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.[14][15]

S0461 SDBbot

SDBbot can collected the country code of a compromised machine.[16]

G1008 SideCopy

SideCopy has identified the country location of a compromised host.[17]

S1124 SocGholish

SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.[18]


This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.


ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may gather information in an attempt to calculate the geographical location of a victim host.

DS0009 Process OS API Execution

Remote access tools with built-in features may interact directly with the Windows API, such as calling GetLocaleInfoW to gather information.[1]

Process Creation

Monitor newly executed processes that may gather information in an attempt to calculate the geographical location of a victim host.