Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
command_promptwindowsDiscover System Language by Registry Query
Identify System language by querying the registry on an endpoint.
Upon successful execution, result in number format can be looked up to correlate the language.
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language
command_promptwindowsDiscover System Language with chcp
Identify System language with the chcp command.
Upon successful execution, result in number format can be looked up to correlate the language.
chcp
shlinuxDiscover System Language with locale
Identify System language with the `locale` command.
Upon successful execution, the output will contain the environment variables that indicate
the 5 character locale that can be looked up to correlate the language and territory.
locale
shlinuxDiscover System Language with localectl
Identify System language with the `localectl` command.
Upon successful execution, the key `System Locale` from the output will contain the
`LANG` environment variable that has the 5 character locale result that can be looked
up to correlate the language and territory.
localectl status
shlinuxDiscover System Language by locale file
Identify System language with the by reading the locale configuration file.
The locale configuration file contains the `LANG` environment variable which
will contain the 5 character locale that can be looked up to correlate the
language and territory.
[ -f /etc/locale.conf ] && cat /etc/locale.conf || cat /etc/default/locale
shlinuxDiscover System Language by Environment Variable Query
Identify System language by checking the environment variables
Upon successful execution, the 5 character locale result can be looked up to
correlate the language and territory. Environment query commands are likely
to run with a pattern match command e.g. `env | grep LANG`
Note: `env` and `printenv` will usually provide the same results. `set` is
also used as a builtin command that does not generate syscall telemetry but
does provide a list of the environment variables.
env | grep LANG
printenv LANG
set | grep LANG
command_promptelevatedwindowsDiscover System Language with dism.exe
The Windows utility DISM (Deployment Image Servicing and Management) can be used to display information about international settings and languages on the currently installed Windows image using an elevated terminal.
dism.exe /online /Get-Intl
command_promptwindowsDiscover System Language by Windows API Query
This test executes a custom script called LanguageKeyboardLayout.exe which outputs the values of the following Windows API functions to the user terminal:
`GetKeyboardLayout`, `GetKeyboardLayoutList`, `GetUserDefaultUILanguage`, `GetSystemDefaultUILanguage`, `GetUserDefaultLangID`.
Documentation for these functions is located [here](https://learn.microsoft.com/en-us/windows/win32/api/winuser/).
PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe
command_promptwindowsDiscover System Language with WMIC
WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a simplified interface to query and manage Windows system configurations, processes, and hardware information using WMI.
The command in this test retrieves information about the system's locale, operating system language, and multilingual user interface (MUI) languages.
wmic /node:#{target_host} os get Locale,OSLanguage,MUILanguages /format:#{format_style}
powershellwindowsDiscover System Language with Powershell
This PowerShell script collects key system settings, such as the UI language, user language preferences, system locale, current culture, UI culture, and time zone, into a hash table.
It then outputs these settings in a readable key-value format directly to the terminal. The script is simple and efficient for quickly displaying system configuration details.
$info = @{
UILanguage = Get-WinUILanguageOverride
UserLanguages = (Get-WinUserLanguageList).LanguageTag -join ', '
SystemLocale = Get-WinSystemLocale
CurrentCulture = [System.Globalization.CultureInfo]::CurrentCulture.Name
CurrentUICulture = [System.Globalization.CultureInfo]::CurrentUICulture.Name
TimeZone = (Get-TimeZone).Id
}
$info.GetEnumerator() | ForEach-Object { "$($_.Name): $($_.Value)" }