Windows Registry Query for System Language Using reg.exe
Flags reg.exe registry queries to Control\Nls\Language, indicating system language discovery on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2026-01-09
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of reg.exe where the command line queries the registry path Control\Nls\Language. System language discovery can help an attacker infer user locale to guide targeting, regional payload customization, or evasion decisions. The detection relies on Windows process creation telemetry, matching both the reg.exe binary and the specific query terms in the command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Query for System Language Using reg.exe
id: aae48e76-2355-463c-b187-82caf23e5385
status: experimental
description: This rule identifies process executions of reg.exe where the command line queries the registry path Control\Nls\Language. System language discovery can help an attacker infer user locale to guide targeting, regional payload customization, or evasion decisions. The detection relies on Windows process creation telemetry, matching both the reg.exe binary and the specific query terms in the command line.
references:
- https://scythe.io/threat-thursday/threatthursday-darkside-ransomware
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-01-09
tags:
- attack.discovery
- attack.t1614.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_cli:
CommandLine|contains|all:
- query
- Control\Nls\Language
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/info.yml
simulation:
- type: atomic-red-team
name: Discover System Language by Registry Query
technique: T1614.001
atomic_guid: 631d4cf1-42c9-4209-8fe9-6bd4de9421be
license: DRL-1.1
related:
- id: c43a5405-e8e1-4221-9ac9-dbe3fa14e886
type: derived