Automation · API / MCP 中文

Technique note · T1614

System Location Discovery

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.

ATT&CK T1614 platforms — Status Active Version 20.1

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.123 Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.4 In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.56 Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.78

  1. FBI Ragnar Locker 2020
  2. Sophos Geolocation 2016
  3. Bleepingcomputer RAT malware 2020
  4. FBI Ragnar Locker 2020
  5. AWS Instance Identity Documents
  6. Microsoft Azure Instance Metadata 2021
  7. Securelist Trasparent Tribe 2020
  8. Sophos Geolocation 2016

Groups using this technique

GroupNameCountry
grp_g1008SideCopyPakistan
grp_g1017Volt Typhoon—

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.