| name | T1614_system-location-discovery |
| description | Adversaries may gather information in an attempt to calculate the geographical location of a victim host. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1614","discovery","iaas","linux","macos","windows"] |
| technique_id | T1614 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["IaaS","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1614 |
| tech_stack | ["cloud","linux","macos","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1614.001"] |
| prerequisites | [] |
| severity_boost | {"T1614.001":"Chain with T1614.001 for deeper attack path"} |
T1614 System Location Discovery
High-Level Description
Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.
Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.
Kill Chain Phase
Platforms: IaaS, Linux, macOS, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Get geolocation info through IP-Lookup services using curl Windows
Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/
Supported Platforms: windows
#{curl_path} -k #{ip_lookup_url}
Dependencies:
