Shell tools query the host timezone and locale settings

Siemphony@siemphonylowT1614unverifiedPlaybook · Discovery and enumeration

Matches AN0120's Linux leg directly: an execution of timedatectl, localectl or locale, or any command line naming /etc/timezone, /etc/localtime or the zoneinfo database, which is how a host's geographic position is inferred from the shell. MITRE names locale, timedatectl and cat /etc/timezone as examples and gives UserContext as the tuning knob; localectl and the zoneinfo path are authored here rather than taken from MITRE. AN0119's Windows leg was deliberately not authored — its observable is an in-process GetLocaleInfoW or GetTimeZoneInformation API call, which a process-creation feed structurally cannot see, and language-only discovery on Windows is already covered at T1614.001. The rule is written in the Sigma linux process_creation vocabulary (Image, CommandLine) that the brief supplies; a raw auditd SYSCALL feed carries the same facts as exe= and a0..aN and needs a field mapping before this logic applies, and auditd records no execve at all until an explicit execve audit rule is loaded. Two structural blind spots to be plain about: a binary that reads /etc/localtime with open() or calls localtime() inside its own process creates no event here, and the IP-geolocation lookup the technique also describes needs a network log source that this brief does not offer. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0043, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Shell tools query the host timezone and locale settings2id: 89516881-07b1-4c66-b162-2a7a8afbfcf53status: experimental4description: |5  Matches AN0120's Linux leg directly: an execution of timedatectl, localectl6  or locale, or any command line naming /etc/timezone, /etc/localtime or the7  zoneinfo database, which is how a host's geographic position is inferred8  from the shell. MITRE names locale, timedatectl and cat /etc/timezone as9  examples and gives UserContext as the tuning knob; localectl and the10  zoneinfo path are authored here rather than taken from MITRE. AN0119's11  Windows leg was deliberately not authored — its observable is an in-process12  GetLocaleInfoW or GetTimeZoneInformation API call, which a process-creation13  feed structurally cannot see, and language-only discovery on Windows is14  already covered at T1614.001. The rule is written in the Sigma linux15  process_creation vocabulary (Image, CommandLine) that the brief supplies; a16  raw auditd SYSCALL feed carries the same facts as exe= and a0..aN and needs17  a field mapping before this logic applies, and auditd records no execve at18  all until an explicit execve audit rule is loaded. Two structural blind19  spots to be plain about: a binary that reads /etc/localtime with open() or20  calls localtime() inside its own process creates no event here, and the21  IP-geolocation lookup the technique also describes needs a network log22  source that this brief does not offer.23  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0043, not hand-written and not tested by its author. Any lab result is on this rule's own page.24references:25  - https://attack.mitre.org/techniques/T161426  - https://attack.mitre.org/detectionstrategies/DET004327author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1729tags:30  - attack.discovery31  - attack.t161432logsource:33  category: process_creation34  product: linux35detection:36  selection_tools:37    Image|endswith:38      - '/timedatectl'39      - '/localectl'40      - '/locale'41  selection_tzfiles:42    CommandLine|contains:43      - '/etc/timezone'44      - '/etc/localtime'45      - '/usr/share/zoneinfo'46  condition: 1 of selection*47falsepositives:48  - "Configuration management convergence runs — the Ansible, Puppet, Chef, Salt and cloud-init timezone modules all shell out to timedatectl or relink /etc/localtime to a path under /usr/share/zoneinfo on every run, which on a managed fleet is the highest-volume match by a wide margin and repeats on the agent's schedule rather than on human activity."49  - "Container image builds and entrypoint scripts that set or confirm the timezone by linking a zoneinfo file into /etc/localtime, plus tzdata package upgrades whose maintainer scripts read the same files across every host in a patch wave."50  - "Installer and packaging scripts that run locale to decide which language pack, charset or number format to configure before writing their own config, common in dpkg and rpm post-install hooks."51  - "An administrator troubleshooting a clock-skew or NTP ticket, where timedatectl with no arguments is the first command typed and prints exactly the timezone an adversary would be after."52level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/timedatectl" or FolderPath endswith "/localectl" or FolderPath endswith "/locale") or (ProcessCommandLine contains "/etc/timezone" or ProcessCommandLine contains "/etc/localtime" or ProcessCommandLine contains "/usr/share/zoneinfo"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/timedatectl" OR Image="*/localectl" OR Image="*/locale") OR (CommandLine="*/etc/timezone*" OR CommandLine="*/etc/localtime*" OR CommandLine="*/usr/share/zoneinfo*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/timedatectl" OR TO_LOWER(process.executable) LIKE "*/localectl" OR TO_LOWER(process.executable) LIKE "*/locale") OR (TO_LOWER(process.command_line) LIKE "*/etc/timezone*" OR TO_LOWER(process.command_line) LIKE "*/etc/localtime*" OR TO_LOWER(process.command_line) LIKE "*/usr/share/zoneinfo*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/timedatectl$|/localectl$|/locale$)</field>    <description>Shell tools query the host timezone and locale settings (1/2)</description>    <mitre>      <id>T1614</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(/etc/timezone|/etc/localtime|/usr/share/zoneinfo)</field>    <description>Shell tools query the host timezone and locale settings (2/2)</description>    <mitre>      <id>T1614</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: network_service_discovery
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 89516881-07b1-4c66-b162-2a7a8afbfcf5

ATT&CKT1614

T1614System Location Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1614, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE gives exactly one knob for AN0120: UserContext. The rule deliberately matches every user, so this is where your work goes. Identify the accounts your configuration-management and monitoring agents run under and exclude them by User, which linux process_creation carries. Suppress image builds and patch windows by time rather than by content. What survives is a shell tool asking about geography under an interactive or service account with no reason to.

Declared by the author

Configuration management convergence runs — the Ansible, Puppet, Chef, Salt and cloud-init timezone modules all shell out to timedatectl or relink /etc/localtime to a path under /usr/share/zoneinfo on every run, which on a managed fleet is the highest-volume match by a wide margin and repeats on the agent's schedule rather than on human activity.
Container image builds and entrypoint scripts that set or confirm the timezone by linking a zoneinfo file into /etc/localtime, plus tzdata package upgrades whose maintainer scripts read the same files across every host in a patch wave.
Installer and packaging scripts that run locale to decide which language pack, charset or number format to configure before writing their own config, common in dpkg and rpm post-install hooks.
An administrator troubleshooting a clock-skew or NTP ticket, where timedatectl with no arguments is the first command typed and prints exactly the timezone an adversary would be after.

Lessonnetwork service discovery

network service discoveryAI draft — unreviewed

01 · What this rule detects

An adversary working out where a compromised Linux host physically sits before deciding what to do with it — timezone, locale and keyboard layout are the cheapest proxies for country. The rule covers AN0120, the Linux leg of DET0043, and nothing else. AN0119's Windows leg is not authored: its observable is an in-process GetLocaleInfoW or GetTimeZoneInformation call, which a process-creation feed structurally cannot see.

02 · Telemetry you need

Linux process creation carrying Image and CommandLine — Sysmon for Linux, or an auditd pipeline that resolves exe= and the a0..aN argument vector into those two Sigma fields. Raw auditd is not enough on its own: it names the fields differently, so a mapping has to exist first, and auditd emits no execve records at all until an explicit execve audit rule is loaded. A host running auditd with no such rule returns zero rows, and zero rows here means blind, not quiet.

03 · How the logic works

Two independent selections joined by 1 of selection*. selection_tools matches Image|endswith on /timedatectl, /localectl and /locale. MITRE names locale and timedatectl in AN0120's description; localectl is the pipeline's own addition. All three are compiled binaries rather than shell wrappers, so an endswith on the image path is live. selection_tzfiles matches CommandLine|contains on /etc/timezone, /etc/localtime and /usr/share/zoneinfo. MITRE cites parsing /etc/timezone; the other two paths are authored here. This leg catches cat, readlink, ls and anything else that names a timezone file as an argument, without having to enumerate readers by name. date and hwclock are excluded on volume grounds, not because they fail to disclose the timezone.

04 · Common false positives

Almost all of it is automation. Configuration management dominates: the Ansible, Puppet, Chef, Salt and cloud-init timezone modules shell out to timedatectl or relink /etc/localtime into /usr/share/zoneinfo on every convergence run. Container entrypoints and tzdata upgrades touch the same files across a whole patch wave. Installer hooks run locale to pick a language pack. Monitoring and compliance agents — osquery packs, NTP-drift checks, CIS scanners — poll this state on a fixed interval, so their volume is continuous rather than episodic. And an admin opening a clock-skew ticket types timedatectl first. level: low is set against that first false positive, which is the highest-volume match by a wide margin.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until it has been run against real data. This rule has never been executed against a log line; it is authored from MITRE prose, so its false positives are reasoned rather than measured. The blind spots are structural: a binary that calls localtime() or open()s /etc/localtime in-process creates no event, the shell expands $(readlink /etc/localtime) before exec so the zoneinfo path never reaches a command line, and the IaaS instance-metadata availability-zone lookup the technique also describes is left unauthored because AN0120 does not describe it. Run it in count mode against your own estate, look at what comes back, and only then call it a detection.

Related detections1 nearby

Detect system time and time zone discovery on the command line

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/89516881-07b1-4c66-b162-2a7a8afbfcf5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shell tools query the host timezone and locale settings

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it