Windows Registry Query for System Language Using reg.exe

title: Windows Registry Query for System Language Using reg.exe
id: aae48e76-2355-463c-b187-82caf23e5385
status: experimental
description: This rule identifies process executions of reg.exe where the command line queries the registry path Control\Nls\Language. System language discovery can help an attacker infer user locale to guide targeting, regional payload customization, or evasion decisions. The detection relies on Windows process creation telemetry, matching both the reg.exe binary and the specific query terms in the command line.
references:
  - https://scythe.io/threat-thursday/threatthursday-darkside-ransomware
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-01-09
tags:
  - attack.discovery
  - attack.t1614.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_cli:
    CommandLine|contains|all:
      - query
      - Control\Nls\Language
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/info.yml
simulation:
  - type: atomic-red-team
    name: Discover System Language by Registry Query
    technique: T1614.001
    atomic_guid: 631d4cf1-42c9-4209-8fe9-6bd4de9421be
license: DRL-1.1
related:
  - id: c43a5405-e8e1-4221-9ac9-dbe3fa14e886
    type: derived