AN0119
Analytic 0119
Windows
Unusual process or API usage attempting to query system locale, timezone, or keyboard layout (e.g., calls to GetLocaleInfoW, GetTimeZoneInformation). Detection can be enhanced by correlating with processes not typically associated with system configuration queries, such as unknown binaries or scripts.
WinEventLog:Security
EventCode=4688
etw:Microsoft-Windows-Kernel-Base
GetLocaleInfoW, GetTimeZoneInformation API calls
[ParentProcessAllowList]
Defines trusted processes expected to call locale APIs. Deviations may indicate adversarial activity.
[TimeWindow]
Specifies correlation window for API calls and suspicious process execution (e.g., 2m).
AN0120
Analytic 0120
Linux
Detection of commands accessing locale, timezone, or language settings such as 'locale', 'timedatectl', or parsing /etc/timezone. Anomalous execution by unusual users or automation scripts should be flagged.
auditd:SYSCALL
execve calls to locale, timedatectl, or cat /etc/timezone
linux:Sysmon
EventCode=1
[UserContext]
Unexpected users running location discovery commands may indicate malicious behavior.
AN0121
Analytic 0121
macOS
Detection of system calls or commands accessing system locale (e.g., 'defaults read -g AppleLocale', 'systemsetup -gettimezone'). Correlate with unusual parent processes or execution contexts.
macos:unifiedlog
defaults read -g AppleLocale, systemsetup -gettimezone
macos:osquery
execve
[ExecutionPath]
Restrict known binaries allowed to query system locale on macOS.
AN0122
Analytic 0122
IaaS
Detection of queries to instance metadata services (e.g., AWS IMDS, Azure Metadata Service) for availability zone, region, or network geolocation details. Correlation with non-management accounts or non-standard workloads may indicate adversary reconnaissance.
AWS:CloudTrail
GetMetadata, DescribeInstanceIdentity
azure:vpcflow
HTTP requests to 169.254.169.254 or Azure Metadata endpoints
[MetadataQueryAllowList]
Expected services that query cloud metadata APIs. Any additional sources may be malicious.