System Language Discovery via Reg.Exe
This query will detect when reg.exe is used to query the Windows registry for language settings under the Control\Nls\Language key. That registry path stores information about system locale and language configuration Attackers sometimes query or modify these registry keys to understand or change the system’s language/locale settings. Malware may check the system language to avoid execution in certain regions (e.g., skipping machines in Russia or China)
SentinelOne
