Locale Check Used for Sandbox or Target Evasion

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects network traffic (HTTP response) from a server to a client that contains both 'GetUserDefaultLCID' and 'ExitProcess' in the file data, case-insensitively. This combination of strings is indicative of malware attempting to evade sandboxes or target specific locales by checking the system's default locale identifier and then potentially exiting if the environment is not suitable. This behavior is often associated with trojan activity.