Locale Enumeration via PowerShell

Daniel Koifman@Koifsec

•updated Mar 31, 2026•10•0•89

This rule detects PowerShell commands that are used to enumerate locale-related system information. Specifically, it looks for PowerShell or pwsh.exe processes executing commands containing keywords like 'InstalledUICulture', 'Get-UICulture', 'CurrentUICulture', 'CurrentThread.CurrentUICulture', 'DefaultThreadCurrentUICulture', 'OSLanguage', or 'MUILanguages'. This activity can be indicative of an adversary attempting to gather system configuration details, potentially for environmental awareness or to tailor subsequent actions.