Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.[1][2][3] Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.[1] In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.[4][5]
Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.[6][2]
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ❌ |
| 行为透明 | ✅ |
| 数据遮蔽 | ❌ |
| 时空释痕 | ✅ |
系统位置发现技术使用操作系统自带的合法API（如 GetLocaleInfoW函数）或外部合法远程工具（如IP地理位置查询服务）来推测系统的位置。在这些系统允许的合法操作下，攻击者的行为看似正常，与常规系统操作或外部互联网查询活动无异，不会引起异常警报，防御者难以辨别异常行为。
通过代理节点动态轮换和低频次分布式查询，将集中式位置发现任务分散至长时间跨度和多地理区域。合法API寄生技术中的请求碎片化策略，使得单次侦察行为特征浓度被稀释在服务商每日数亿级别的合法请求中，传统基于时间窗口或空间聚类的检测模型难以生效。
| ID | Name | Description |
|---|---|---|
| S1025 | Amadey |
Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.[7] |
| S0115 | Crimson |
Crimson can identify the geographical location of a victim host.[8] |
| S1153 | Cuckoo Stealer |
Cuckoo Stealer can determine the geographical location of a victim host by checking the language.[9] |
| S1111 | DarkGate |
DarkGate queries system locale information during execution.[10] Later versions of DarkGate query |
| S0673 | DarkWatchman |
DarkWatchman can identity the OS locale of a compromised host.[12] |
| S1138 | Gootloader |
Gootloader can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.[13] |
| S0632 | GrimAgent |
GrimAgent can identify the country code on a compromised host.[14] |
| S0262 | QuasarRAT |
QuasarRAT can determine the country a victim host is located in.[15] |
| S1148 | Raccoon Stealer |
Raccoon Stealer collects the |
| S0481 | Ragnar Locker |
Before executing malicious code, Ragnar Locker checks the Windows API |
| S1018 | Saint Bot |
Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.[17][18] |
| S0461 | SDBbot |
SDBbot can collected the country code of a compromised machine.[19] |
| G1008 | SideCopy |
SideCopy has identified the country location of a compromised host.[20] |
| S1124 | SocGholish |
SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.[21] |
| G1017 | Volt Typhoon |
Volt Typhoon has obtained the victim's system current location.[22] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may gather information in an attempt to calculate the geographical location of a victim host. |
| DS0009 | Process | OS API Execution |
Remote access tools with built-in features may interact directly with the Windows API, such as calling |
| Process Creation |
Monitor newly executed processes that may gather information in an attempt to calculate the geographical location of a victim host. |