System Language Discovery via Reg.Exe

calendar Mar 1, 2026 · attack.discovery attack.t1614.001  ·
Share on: linkedin copy

Detects the usage of Reg.Exe to query system language settings. Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions, or avoid targeting certain locales to evade detection.

Sigma rule (View on GitHub)

 1title: System Language Discovery via Reg.Exe
 2id: c43a5405-e8e1-4221-9ac9-dbe3fa14e886
 3status: experimental
 4description: |
 5    Detects the usage of Reg.Exe to query system language settings.
 6    Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
 7    or avoid targeting certain locales to evade detection.    
 8references:
 9    - https://scythe.io/threat-thursday/threatthursday-darkside-ransomware
10author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
11date: 2026-01-09
12tags:
13    - attack.discovery
14    - attack.t1614.001
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection_img:
20        - Image|endswith: '\reg.exe'
21        - OriginalFileName: 'reg.exe'
22    selection_cli:
23        CommandLine|contains|all:
24            - 'query'
25            - 'Control\Nls\Language'
26    condition: all of selection_*
27falsepositives:
28    - Unknown
29level: medium
30regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/info.yml
31simulation:
32    - type: atomic-red-team
33      name: Discover System Language by Registry Query
34      technique: T1614.001
35      atomic_guid: 631d4cf1-42c9-4209-8fe9-6bd4de9421be

References

  • SCYTHE Library: #ThreatThursday - DarkSide Ransomware

    In this blog we consume Cyber Threat Intelligence to understand how the DarkSide ransomware behaves, we create and share an adversary emulation plan so you can quickly test, measure, and improve your people, process, and technology for similar attacks, and we discuss how to detect and respond to DarkSide ransomware.


    Read More

Related rules

to-top