Gopi C B
@ChettaCompletionist
0 followers15 downloads9 copies1 like296 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Platforms
2
Products / Services
1
MITRE Techniques
1
1
1
1
This query will detect when reg.exe is used to query the Windows registry for language settings under the Control\Nls\Language key. That registry path stores information about system locale and language configuration
Attackers sometimes query or modify these registry keys to understand or change the system’s language/locale settings.
Malware may check the system language to avoid execution in certain regions (e.g., skipping machines in Russia or China)
Attackers sometimes query or modify these registry keys to understand or change the system’s language/locale settings.
Malware may check the system language to avoid execution in certain regions (e.g., skipping machines in Russia or China)
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.