Process queries the system locale via registry lookup or PowerShell

Siemphony@siemphonylowT1614.001unverifiedPlaybook · Discovery and enumeration

Matches process creation where reg.exe is invoked against the NLS Language registry path, or where powershell.exe/pwsh.exe runs one of the locale-query cmdlets that wrap GetUserDefaultUILanguage and the related Win32 calls AN1561 names. The brief also offers Security EventID 4657 on the same registry key as a second log source, mapped onto Sigma's registry_set category, but 4657 is "a registry value was modified" — it fires on SetValueKey, not on the read a language-discovery query performs, so that selector would never match this behaviour and is deliberately not authored. The rule is written in the Sysmon EventID 1 process-creation vocabulary the brief also supplies, which needs no extra audit policy; a Security 4688 feed carries the same facts under NewProcessName/CommandLine and additionally needs Audit Process Creation plus Include command line in process creation events enabled. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0565, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Process queries the system locale via registry lookup or PowerShell2id: 07d5e808-83e9-4f8e-a8be-6fc8707374053status: experimental4description: |5  Matches process creation where reg.exe is invoked against the NLS Language6  registry path, or where powershell.exe/pwsh.exe runs one of the locale-query7  cmdlets that wrap GetUserDefaultUILanguage and the related Win32 calls AN15618  names. The brief also offers Security EventID 4657 on the same registry key9  as a second log source, mapped onto Sigma's registry_set category, but 465710  is "a registry value was modified" — it fires on SetValueKey, not on the read11  a language-discovery query performs, so that selector would never match this12  behaviour and is deliberately not authored. The rule is written in the13  Sysmon EventID 1 process-creation vocabulary the brief also supplies, which14  needs no extra audit policy; a Security 4688 feed carries the same facts15  under NewProcessName/CommandLine and additionally needs Audit Process16  Creation plus Include command line in process creation events enabled.17  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0565, not hand-written and not tested by its author. Any lab result is on this rule's own page.18references:19  - https://attack.mitre.org/techniques/T1614/00120  - https://attack.mitre.org/detectionstrategies/DET056521author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)22date: 2026-08-1623tags:24  - attack.discovery25  - attack.t1614.00126logsource:27  category: process_creation28  product: windows29detection:30  selection_reg:31    Image|endswith: '\reg.exe'32    CommandLine|contains: 'Nls\Language'33  selection_ps:34    Image|endswith:35      - '\powershell.exe'36      - '\pwsh.exe'37    CommandLine|contains:38      - 'Get-WinSystemLocale'39      - 'Get-UICulture'40      - 'Get-Culture'41      - 'Get-WinUserLanguageList'42  condition: selection_reg or selection_ps43falsepositives:44  - "Helpdesk and IT-support scripts that check a workstation's locale as a routine step while troubleshooting keyboard-layout or regional-format complaints, using the exact reg query or PowerShell cmdlets this rule matches."45  - "Imaging, provisioning and Autopilot deployment scripts that call Get-WinSystemLocale or Get-WinUserLanguageList to confirm the correct language pack landed after OS deployment."46  - "Multi-language software installers that query the OS locale via reg.exe or a PowerShell cmdlet as a preflight step before choosing which localized UI to present."47level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\reg.exe" and ProcessCommandLine contains "Nls\\Language") or ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "Get-WinSystemLocale" or ProcessCommandLine contains "Get-UICulture" or ProcessCommandLine contains "Get-Culture" or ProcessCommandLine contains "Get-WinUserLanguageList")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\reg.exe" AND CommandLine="*Nls\\Language*") OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Get-WinSystemLocale*" OR CommandLine="*Get-UICulture*" OR CommandLine="*Get-Culture*" OR CommandLine="*Get-WinUserLanguageList*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\reg.exe" AND TO_LOWER(process.command_line) LIKE "*nls\\\\language*") OR ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*get-winsystemlocale*" OR TO_LOWER(process.command_line) LIKE "*get-uiculture*" OR TO_LOWER(process.command_line) LIKE "*get-culture*" OR TO_LOWER(process.command_line) LIKE "*get-winuserlanguagelist*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\reg\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)Nls\\Language</field>    <description>Process queries the system locale via registry lookup or PowerShell (1/2)</description>    <mitre>      <id>T1614.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(Get-WinSystemLocale|Get-UICulture|Get-Culture|Get-WinUserLanguageList)</field>    <description>Process queries the system locale via registry lookup or PowerShell (2/2)</description>    <mitre>      <id>T1614.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: network_service_discovery
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 07d5e808-83e9-4f8e-a8be-6fc870737405

ATT&CKT1614.001

T1614.001System Language Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1614.001, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the general-purpose formatting use of Get-Culture/Get-UICulture as a named false positive, and consider whether those two cmdlets belong in the same selector as the two more discovery-specific ones (Get-WinSystemLocale, Get-WinUserLanguageList) at all, or whether they warrant a separate, lower-confidence selection. On evasion: Get-ItemProperty or Get-ItemPropertyValue against the same registry path, or a direct Win32 call via P/Invoke from a compiled binary, bypass every selector here — the rule only watches reg.exe's literal command line and four named cmdlets, not the underlying read.

Declared by the author

Helpdesk and IT-support scripts that check a workstation's locale as a routine step while troubleshooting keyboard-layout or regional-format complaints, using the exact reg query or PowerShell cmdlets this rule matches.
Imaging, provisioning and Autopilot deployment scripts that call Get-WinSystemLocale or Get-WinUserLanguageList to confirm the correct language pack landed after OS deployment.
Multi-language software installers that query the OS locale via reg.exe or a PowerShell cmdlet as a preflight step before choosing which localized UI to present.

Lessonnetwork service discovery

network service discoveryAI draft — unreviewed

01 · What this rule detects

AN1561 describes registry access to system-language keys and calls to locale-related Win32 APIs (GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList) — checks malware uses to infer a victim's geography before deciding whether to proceed. This rule matches the two command-line-visible ways that behaviour surfaces: reg.exe queried against the NLS Language key, and PowerShell or pwsh running one of four cmdlets that wrap those same Win32 calls. Neither branch can see a compiled binary calling the API directly — command-line telemetry only sees what a process was told to run, not what it linked against.

02 · Telemetry you need

Sysmon EventID 1, category: process_creation / product: windows, needing no special audit policy. The brief also offers Security EventID 4657 on the same registry key, mapped onto Sigma's registry_set category, and the rule deliberately doesn't use it — worth understanding why, since it's a pattern worth recognizing elsewhere. 4657 is "a registry value was modified"; it fires on SetValueKey, not on a read. A language-discovery query reads the key, so it would never trip 4657 no matter how well configured the SACL is. Leaving that log source unauthored here isn't a missed selector — it's correctly recognizing that the analytic's second log source structurally cannot see the behaviour AN1561 describes.

03 · How the logic works

Two selections, ORed: selection_reg requires Image|endswith: '\reg.exe' and CommandLine|contains: 'Nls\Language'; selection_ps requires Image ending in powershell.exe or pwsh.exe, and CommandLine containing one of Get-WinSystemLocale, Get-UICulture, Get-Culture, or Get-WinUserLanguageList. Wazuh refuses this rule outright — it can't express an OR across different fields (Image and CommandLine together, duplicated across two selections) in a single rule — and that refusal is recorded rather than contorted into something that would parse but mean something different.

04 · Common false positives

The three listed false positives are all deliberate, intentional locale queries: helpdesk troubleshooting keyboard-layout complaints using the exact commands this rule matches; imaging and Autopilot deployment scripts confirming the correct language pack landed post-deployment; and multi-language installers doing a locale preflight before choosing a UI.
A reviewer caught something none of the three describe: Get-Culture and Get-UICulture are not discovery-specific commands at all. They're used constantly in ordinary PowerShell scripting for locale-aware date, number, and string formatting — build scripts, output-formatting modules, localization-aware line-of-business code — with zero connection to reconnaissance intent. On any estate with non-trivial PowerShell tooling, this is plausibly the single largest source of matches, and it's a different kind of noise than the three listed: not "someone deliberately checked the locale," but "a cmdlet name matched regardless of why it was called." The rule's level: low likely still holds once that volume is accounted for, but not for the reasons currently written down.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line. The `Get-Culture` volume concern above is reasoning about how PowerShell is used in practice, not a measured hit rate.
tier_2: means running this against real script-block or command-line telemetry to see how much of the match volume is formatting versus genuine discovery intent.
tier_3: ** would correlate a locale query with subsequent network-facing or conditional-execution behaviour, since a benign formatting call has no follow-on and a reconnaissance check usually does.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/07d5e808-83e9-4f8e-a8be-6fc870737405

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process queries the system locale via registry lookup or PowerShell

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it