AN1561
Analytic 1561
Windows
Registry access to system language keys (e.g., HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language) or suspicious processes invoking locale-related APIs (e.g., GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList). Defender visibility focuses on anomalous or non-standard processes issuing these queries, especially when run by unknown binaries or scripts.
WinEventLog:Security
EventCode=4657
WinEventLog:Sysmon
EventCode=1
ETW
Calls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList
[ParentProcessAllowList]
Defines trusted processes allowed to query registry language keys or APIs. Unexpected parent-child process chains may indicate adversary use.
[QueryThreshold]
Frequency threshold for language registry or API calls within a set time window.
AN1562
Analytic 1562
Linux
Processes executing commands to query system locale and language settings, such as 'locale', 'echo $LANG', or parsing environment variables. Suspicious activity is indicated by these commands being run by unusual users, automation scripts, or non-administrative processes.
auditd:SYSCALL
execve calls to /usr/bin/locale or shell execution of $LANG
linux:Sysmon
EventCode=1
[UserContext]
Unexpected or non-admin users executing locale commands may suggest malicious behavior.
AN1563
Analytic 1563
macOS
Execution of commands to query system locale and language settings, such as 'defaults read -g AppleLocale' or 'systemsetup -gettimezone'. Unusual parent processes or execution contexts of these commands may indicate adversarial discovery.
macos:unifiedlog
defaults read -g AppleLocale or systemsetup -gettimezone
macos:osquery
execve
[ExecutionPath]
Restrict or monitor processes outside of system utilities that query AppleLocale or system language settings.