System Location Discovery (T1614)

Tactic: Discovery

Tactics
Discovery
Platforms
IaaS, Linux, macOS, Windows
Reference
attack.mitre.org/techniques/T1614

Description

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance’s availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021)

Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)

Sub-techniques

How GTK Cyber trains on this

GTK Cyber's hands-on training programs cover detection engineering across the MITRE ATT&CK framework, including the Discovery tactic this technique falls under. Our practitioner-led courses focus on building real detections, not just memorizing technique IDs.

View training courses →

Related techniques

Train your team on real attack techniques.

GTK Cyber's hands-on courses are taught by practitioners who detect this stuff for a living.

View Courses