自动化接入 · API / MCP EN

技术说明 · T1614

System Location Discovery

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.

ATT&CK T1614 platforms — 状态 有效 版本 20.1

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.123 Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.4 In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.56 Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.78

  1. FBI Ragnar Locker 2020
  2. Sophos Geolocation 2016
  3. Bleepingcomputer RAT malware 2020
  4. FBI Ragnar Locker 2020
  5. AWS Instance Identity Documents
  6. Microsoft Azure Instance Metadata 2021
  7. Securelist Trasparent Tribe 2020
  8. Sophos Geolocation 2016

使用该技术的组织

组织名称国家
grp_g1008SideCopyPakistan
grp_g1017Volt Typhoon—

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。