{"id":"c43a5405-e8e1-4221-9ac9-dbe3fa14e886","title":"System Language Discovery via Reg.Exe","description":"Detects the usage of Reg.Exe to query system language settings.\nAttackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,\nor avoid targeting certain locales to evade detection.\n","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-01-09","modified":"","tags":["attack.discovery","attack.t1614.001"],"technique_ids":["T1614.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://scythe.io/threat-thursday/threatthursday-darkside-ransomware"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_system_language_discovery.yml","source_sha256":"533b9cc3f112b7af6b3399ae079ce18b03cd0ae29159e0290b20142b2653ff5e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Language Discovery via Reg.Exe\nid: c43a5405-e8e1-4221-9ac9-dbe3fa14e886\nstatus: experimental\ndescription: |\n    Detects the usage of Reg.Exe to query system language settings.\n    Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,\n    or avoid targeting certain locales to evade detection.\nreferences:\n    - https://scythe.io/threat-thursday/threatthursday-darkside-ransomware\nauthor: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)\ndate: 2026-01-09\ntags:\n    - attack.discovery\n    - attack.t1614.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'query'\n            - 'Control\\Nls\\Language'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Discover System Language by Registry Query\n      technique: T1614.001\n      atomic_guid: 631d4cf1-42c9-4209-8fe9-6bd4de9421be\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1614.001","id":"T1614.001","name":"System Language Discovery","page":"techniques/enterprise/T1614.001/"}],"data_path":"data/detection-rules/c43a5405-e8e1-4221-9ac9-dbe3fa14e886.json","kind":"sigma"}