{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1614","id":"T1614","name":"System Location Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1614","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"38b2b2a1a003f569843a963f0f5a70804295f999fa83cf91c92ded0962376e85","description":"\nAdversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nAdversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021)\n\nAdversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1614","external_id":"T1614"},{"source_name":"Bleepingcomputer RAT malware 2020","description":"Abrams, L. (2020, October 23). New RAT malware gets commands via Discord, has ransomware feature. Retrieved April 1, 2021.","url":"https://www.bleepingcomputer.com/news/security/new-rat-malware-gets-commands-via-discord-has-ransomware-feature/"},{"source_name":"AWS Instance Identity Documents","description":"Amazon. (n.d.). Instance identity documents. Retrieved April 2, 2021.","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html"},{"source_name":"Securelist Trasparent Tribe 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved April 1, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"FBI Ragnar Locker 2020","description":"FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved September 12, 2024.","url":"https://s3.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf"},{"source_name":"Microsoft Azure Instance Metadata 2021","description":"Microsoft. (2021, February 21). Azure Instance Metadata Service (Windows). Retrieved April 2, 2021.","url":"https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=windows"},{"source_name":"Sophos Geolocation 2016","description":"Wisniewski, C. (2016, May 3). Location-based threats: How cybercriminals target you based on where you live. Retrieved April 1, 2021.","url":"https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/"}],"platforms":["IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1614.001","id":"T1614.001","name":"System Language Discovery","page":"techniques/enterprise/T1614.001/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1614","id":"T1614","name":"System Location Discovery","domain":"enterprise","platforms":["IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1614","technique_page":"techniques/enterprise/T1614/","page":"detections/enterprise/T1614/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0043","name":"Detection Strategy for System Location Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0043","stix_id":"x-mitre-detection-strategy--9daf5067-79c3-477c-bf41-813aada4770d","relationship_id":"relationship--2a170a3a-d02a-48ff-a21c-23f373f8951f","description":"","analytics":[{"id":"AN0119","name":"Analytic 0119","guidance":"Unusual process or API usage attempting to query system locale, timezone, or keyboard layout (e.g., calls to GetLocaleInfoW, GetTimeZoneInformation). Detection can be enhanced by correlating with processes not typically associated with system configuration queries, such as unknown binaries or scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0119","platforms":["Windows"],"tuning":[{"field":"ParentProcessAllowList","description":"Defines trusted processes expected to call locale APIs. Deviations may indicate adversarial activity."},{"field":"TimeWindow","description":"Specifies correlation window for API calls and suspicious process execution (e.g., 2m)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0119","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0119","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0021","component":"OS API Execution","name":"etw:Microsoft-Windows-Kernel-Base","channel":"GetLocaleInfoW, GetTimeZoneInformation API calls","platforms":["Windows"],"analytic_id":"AN0119","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0119","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN0120","name":"Analytic 0120","guidance":"Detection of commands accessing locale, timezone, or language settings such as 'locale', 'timedatectl', or parsing /etc/timezone. Anomalous execution by unusual users or automation scripts should be flagged.","url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0120","platforms":["Linux"],"tuning":[{"field":"UserContext","description":"Unexpected users running location discovery commands may indicate malicious behavior."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execve calls to locale, timedatectl, or cat /etc/timezone","platforms":["Linux"],"analytic_id":"AN0120","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0120","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:Sysmon","channel":"EventCode=1","platforms":["Linux"],"analytic_id":"AN0120","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0120","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0121","name":"Analytic 0121","guidance":"Detection of system calls or commands accessing system locale (e.g., 'defaults read -g AppleLocale', 'systemsetup -gettimezone'). Correlate with unusual parent processes or execution contexts.","url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0121","platforms":["macOS"],"tuning":[{"field":"ExecutionPath","description":"Restrict known binaries allowed to query system locale on macOS."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"defaults read -g AppleLocale, systemsetup -gettimezone","platforms":["macOS"],"analytic_id":"AN0121","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0121","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"execve","platforms":["macOS"],"analytic_id":"AN0121","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0121","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0122","name":"Analytic 0122","guidance":"Detection of queries to instance metadata services (e.g., AWS IMDS, Azure Metadata Service) for availability zone, region, or network geolocation details. Correlation with non-management accounts or non-standard workloads may indicate adversary reconnaissance.","url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0122","platforms":["IaaS"],"tuning":[{"field":"MetadataQueryAllowList","description":"Expected services that query cloud metadata APIs. Any additional sources may be malicious."}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"AWS:CloudTrail","channel":"GetMetadata, DescribeInstanceIdentity","platforms":["IaaS"],"analytic_id":"AN0122","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0122","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"azure:vpcflow","channel":"HTTP requests to 169.254.169.254 or Azure Metadata endpoints","platforms":["IaaS"],"analytic_id":"AN0122","source_url":"https://attack.mitre.org/detectionstrategies/DET0043#AN0122","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has obtained the location of the victim device by leveraging `GetSystemDefaultLCID`.(Citation: Eset PlugX Korplug Mustang Panda March 2022)","relationship_id":"relationship--0bb197ea-3530-4cd5-861a-26ef8bb1f6f9","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) can identify the geographical location of a victim host.(Citation: Kaspersky Transparent Tribe August 2020)\t ","relationship_id":"relationship--9f918c84-29ac-4769-ba94-6b46c8ccb950","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"}]},{"id":"S0262","name":"QuasarRAT","url":"https://attack.mitre.org/software/S0262","kind":"tool","description":"[QuasarRAT](https://attack.mitre.org/software/S0262) can determine the country a victim host is located in.(Citation: CISA AR18-352A Quasar RAT December 2018)","relationship_id":"relationship--4f4a052a-7e53-451f-8976-7c6f1623102d","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","description":"CISA. (2018, December 18). Analysis Report (AR18-352A) Quasar Open-Source Remote Administration Tool. Retrieved August 1, 2022.","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can identify the location of targeted devices.(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--e5d5ede1-2e34-4a3a-9328-a151bedff462","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) can collected the country code of a compromised machine.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--70dc4dfe-c859-4665-88d7-ff724d88380b","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"S0481","name":"Ragnar Locker","url":"https://attack.mitre.org/software/S0481","kind":"malware","description":"Before executing malicious code, [Ragnar Locker](https://attack.mitre.org/software/S0481) checks the Windows API <code>GetLocaleInfoW</code> and doesn't encrypt files if it finds a former Soviet country.(Citation: FBI Ragnar Locker 2020)","relationship_id":"relationship--93fdbd36-b577-44bd-b4db-6daadbef9cb2","references":[{"source_name":"FBI Ragnar Locker 2020","description":"FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved September 12, 2024.","url":"https://s3.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf"}]},{"id":"S0632","name":"GrimAgent","url":"https://attack.mitre.org/software/S0632","kind":"malware","description":"[GrimAgent](https://attack.mitre.org/software/S0632) can identify the country code on a compromised host.(Citation: Group IB GrimAgent July 2021)","relationship_id":"relationship--ac7a8c0c-bdbc-4ed5-91f9-b00212fe7189","references":[{"source_name":"Group IB GrimAgent July 2021","description":"Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.","url":"https://www.group-ib.com/blog/grimagent/"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can identity the OS locale of a compromised host.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--00ed8575-5d79-46c3-adea-d0e1bf5dc14a","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--a49fc7fd-5af0-4a2f-a2bb-f1d153e6b66d","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"},{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) does not run any tasks or install additional malware if the victim machine is based in Russia.(Citation: BlackBerry Amadey 2020)","relationship_id":"relationship--e2c08481-c9ad-4929-b470-afd2df7233ed","references":[{"source_name":"BlackBerry Amadey 2020","description":"Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) queries system locale information during execution.(Citation: Ensilo Darkgate 2018) Later versions of [DarkGate](https://attack.mitre.org/software/S1111) query <code>GetSystemDefaultLCID</code> for locale information to determine if the malware is executing in Russian-speaking countries.(Citation: Trellix Darkgate 2023)","relationship_id":"relationship--309c4a23-21dd-41fa-9e0c-ce5c730455fe","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}]},{"id":"S1124","name":"SocGholish","url":"https://attack.mitre.org/software/S1124","kind":"malware","description":"[SocGholish](https://attack.mitre.org/software/S1124) can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.(Citation: Secureworks Gold Prelude Profile)","relationship_id":"relationship--35d76097-4eee-4b37-8b5c-05eec6ab7911","references":[{"source_name":"Secureworks Gold Prelude Profile","description":"Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}]},{"id":"S1138","name":"Gootloader","url":"https://attack.mitre.org/software/S1138","kind":"malware","description":"[Gootloader](https://attack.mitre.org/software/S1138)  can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.(Citation: SentinelOne Gootloader June 2021)","relationship_id":"relationship--02653ee2-6907-4fb5-b946-9cbd4377ad64","references":[{"source_name":"SentinelOne Gootloader June 2021","description":"Pirozzi, A. (2021, June 16). Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets. Retrieved May 28, 2024.","url":"https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) collects the `Locale Name` of the infected device via `GetUserDefaultLocaleName` to determine whether the string `ru` is included, but in analyzed samples no action is taken if present.(Citation: S2W Racoon 2022)","relationship_id":"relationship--9c74284d-dfb7-49c5-85a1-fa8e63de53ad","references":[{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can determine the geographical location of a victim host by checking the language.(Citation: Kandji Cuckoo April 2024)\n","relationship_id":"relationship--1e272852-4033-4e88-8f0a-b957c1a6b74c","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) has gathered detailed information about victims’ systems, such as IP addresses, and geolocation.(Citation: ESET RedLine Stealer November 2024)(Citation: Kroll RedLine Stealer August 2024)(Citation: Proofpoint RedLine Stealer March 2020) [RedLine Stealer](https://attack.mitre.org/software/S1240) has also checked the IP from where it was being executed and leveraged an opensource geolocation IP-lookup service. (Citation: McAfee RedLine Stealer April 2024)","relationship_id":"relationship--79275d9c-25cb-4792-8ac9-57009b44bd35","references":[{"source_name":"ESET RedLine Stealer November 2024","description":"Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"},{"source_name":"Kroll RedLine Stealer August 2024","description":"George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.","url":"https://www.kroll.com/en/publications/cyber/redlinestealer-malware"},{"source_name":"McAfee RedLine Stealer April 2024","description":"Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/"},{"source_name":"Proofpoint RedLine Stealer March 2020","description":"Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.","url":"https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has collected the internal IP address, IP geolocation information of the infected host and sends the data to a C2 server.(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) has also leveraged the “pay” module to obtain region name, country, city, zip code, ISP, latitude and longitude using “http://ip-api.com/json”.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--afb2acec-b781-4f8c-8268-d326d4f4f074","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"S1248","name":"XORIndex Loader","url":"https://attack.mitre.org/software/S1248","kind":"malware","description":"[XORIndex Loader](https://attack.mitre.org/software/S1248) can identify the geographical location of a victim host.(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)","relationship_id":"relationship--4d4ae685-f7bc-4944-84be-6428f3e757f6","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}]},{"id":"S1249","name":"HexEval Loader","url":"https://attack.mitre.org/software/S1249","kind":"malware","description":"[HexEval Loader](https://attack.mitre.org/software/S1249) has a function where the C2 endpoint can identify the geographical location of a victim host based on request headers, execution environment and runtime conditions.(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)","relationship_id":"relationship--ae152041-a294-499e-8f7b-4bc2b3722aba","references":[{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has leveraged geofencing logic to detect whether it is operating in a Russian associated time zone to determine whether it continues to execute.(Citation: Socket GlassWorm January 2026)","relationship_id":"relationship--9d4c9cb8-d5fb-4679-8b38-fab55f237963","references":[{"source_name":"Socket GlassWorm January 2026","description":"Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) can use `kernel32!GetGeoInfo` to determine system location.(Citation: Zscaler PureCrypter JUN 2022)","relationship_id":"relationship--69b96d7c-4606-4dfe-99e6-c64a4a51a0cc","references":[{"source_name":"Zscaler PureCrypter JUN 2022","description":"Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}]},{"id":"S9030","name":"SameCoin","url":"https://attack.mitre.org/software/S9030","kind":"malware","description":"[SameCoin](https://attack.mitre.org/software/S9030) can attempt to connect to the Israel Home Front Command site, oref.org[.]il, which is only reachable from within Israel to verify the target's location.(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--5dd07f94-a3bf-48a3-ad5b-888f5b2953b4","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"id":"S9031","name":"AshTag","url":"https://attack.mitre.org/software/S9031","kind":"malware","description":"[AshTag](https://attack.mitre.org/software/S9031) can check geolocation on targeted systems.(Citation: Palo Alto Ashen Lepus DEC 2025)","relationship_id":"relationship--b73877db-8456-4a79-85c0-1a02d74a0300","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","description":"Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"id":"S9034","name":"Tsundere Botnet","url":"https://attack.mitre.org/software/S9034","kind":"malware","description":"[Tsundere Botnet](https://attack.mitre.org/software/S9034) has checked the victim machine’s location by obtaining the culture name of the machine.(Citation: SecureListUbiedo_Tsundere_Nov2025)","relationship_id":"relationship--288697f9-74a7-4b63-a92c-2c0fa13ef138","references":[{"source_name":"SecureListUbiedo_Tsundere_Nov2025","description":"Ubiedo, L. (2025, November 20). Blockchain and Node.js abused by Tsundere: an emerging botnet. Retrieved April 6, 2026.","url":"https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has discovered the compromised systems location through a query of the system timezone configuration and the locale settings.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)","relationship_id":"relationship--ec5967b6-9b98-432f-a08d-6b04687a4290","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has used the `EnumSystemLocalesW` function to enumerate installed or supported locales on the victim machine.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has also used a GET request to ip-api[.]com, resolving the victim's public IP address and country.(Citation: Unit42_Vidar_July2026)","relationship_id":"relationship--7d2f007d-a013-4637-b7f0-8d73c39361b4","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Unit42_Vidar_July2026","description":"Nannaka, B., Chhaparwal, P. (2026, July 7). Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation. Retrieved July 8, 2026.","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"}]}],"actors":[{"id":"G1008","name":"SideCopy","url":"https://attack.mitre.org/groups/G1008","kind":"intrusion-set","description":"[SideCopy](https://attack.mitre.org/groups/G1008) has identified the country location of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--139cce0b-726b-406a-ad38-1fdfc779cf57","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained the victim's system current location.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--e91aa008-ba7d-4dc0-96da-c2e60969e4da","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]}],"mitigations":[],"candidates":[{"id":"552b4db3-8850-412c-abce-ab5cc8a86604","name":"Get geolocation info through IP-Lookup services using curl freebsd, linux or macos","platforms":["macos","linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1614/T1614.yaml","description":"Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/\n","inputs":{"ip_lookup_url":{"description":"URL of the IP-Lookup service","type":"url","default":"https://ipinfo.io/"}},"dependencies":[],"source_definition_sha256":"d77755e3fbe6bb3a5394dde390336f74a5bf342a787383ffdbad400389e25b72"},{"id":"fe53e878-10a3-477b-963e-4367348f5af5","name":"Get geolocation info through IP-Lookup services using curl Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1614/T1614.yaml","description":"Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/\n","inputs":{"ip_lookup_url":{"description":"URL of the IP-Lookup service","type":"url","default":"https://ipinfo.io/"},"curl_path":{"description":"path to curl.exe","type":"path","default":"C:\\Windows\\System32\\Curl.exe"}},"dependencies":[{"description":"Curl must be installed on system.\n"}],"source_definition_sha256":"b943086a5657194e298f48fddba51f937467b14c2b0b36ebb5a191444ba90e0b"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1614":"/ttp-simulation/techniques/enterprise/T1614/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1614","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}