BirdCall Queries User and Locale Details for Victim Profiling

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•9

Detects a game-related child process collecting username, language, timezone, keyboard layout, and regional settings in one sequence. This rule specifically looks for command-line executions using 'cmd.exe', 'powershell.exe', or 'wmic.exe' that include commands like 'whoami', 'Get-WinSystemLocale', 'Get-TimeZone', 'Get-WinUserLanguageList', 'keyboard layout', or 'Win32_TimeZone'.