T1614 System Location Discovery

Technique: T1614
Tactics: Discovery
Research, 90 days: 5
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 2
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1614

MITRE description

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-10-15 Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering
2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-09-14 Group-IB: Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
2026-09-03 Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action

Detection coverage

Elastic and Splunk rules

External IP Lookup from Non-Browser Process (elastic)
System Time Discovery (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.