Skip to content

System Language Discovery

Subtechnique · ATTACK:enterprise:T1614.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1614.001",
  "title": "System Language Discovery",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1614/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
  "external_id": "T1614.001",
  "domain": "enterprise",
  "created": "2021-08-18T14:06:45.244Z",
  "modified": "2026-05-12T15:12:00.713Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Darkside Ransomware Cybereason",
      "url": "https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware"
    },
    {
      "source_name": "Securelist JSWorm",
      "url": "https://securelist.com/evolution-of-jsworm-ransomware/102428/"
    },
    {
      "source_name": "CrowdStrike Ryuk January 2019",
      "url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
    },
    {
      "source_name": "SecureList SynAck Doppelgänging May 2018",
      "url": "https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"
    },
    {
      "source_name": "Malware System Language Check",
      "url": "https://www.welivesecurity.com/2009/01/15/malware-trying-to-avoid-some-countries/"
    }
  ]
}

Explicit source assertions (43)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04791b5e-1795-4a1c-a10d-71f919fc420e

ClearSky Lazarus Aug 2020

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1285411e-83a3-456a-a211-56896dba2942

Kandji Cuckoo April 2024

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--149fbbae-8c2e-4391-bb93-47375d4a68be

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1878edcb-e458-494c-81a5-34d8a0390957

trendmicro xcsset xcode project 2020

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19f3cd7b-3a05-452f-8198-1efdf8207684

McAfee Cuba April 2021

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a15d017-485e-403b-bad8-da8da074ffed

Microsoft NICKEL December 2021

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a67b676-a119-4968-a0ce-9f6f48b481de

NTT Security Flagpro new December 2021

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cce3898-db84-438a-9a7a-5cea536e00e2

DFIR_Quantum_Ransomware

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d47e8c0-9f0d-41d1-a889-609025b42298

Arxiv Avaddon Feb 2021

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21409e96-7a2f-4109-b23e-1b43005aaaa4

McAfee Maze March 2020

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23d11b47-6a99-47ee-bdb5-c6d1dc558782

ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29639eea-ddaf-44ce-95d3-053ba8a9eeb9

Segurança Informática URSA Sophisticated Loader 2020 · SCILabs Malteiro 2021

ATTACK:enterprise:S0543 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--392980d3-6cac-4740-824c-4911ab10f135

Unit42 Molerat Mar 2020

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39aa1d6a-fbd7-40cf-90ea-4e83ba2c45cd

CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--433a58df-14b4-4fc1-ace7-7610369b7094

Picus BlackByte 2022

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e1f3e6e-33b5-475d-b19b-d9a43227cf1c

CrowdStrike Ryuk January 2019

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51eb6034-e6a2-4917-9276-65eb157afacc

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c12d816-bb1e-4f3b-8247-7a1780d2db01

Sophos Gootloader

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c316caa-ecd9-4185-bd42-16b16343d405

Wiz Mini Shai-Hulud MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--602c1dc8-314c-4149-805a-a9a741aa074e

Cylance Dust Storm

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--602eff7d-5d1c-4023-9fae-a4125df43461

Kaspersky LODEINFO Part II OCT 2022

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--682dad6a-277f-46ae-8416-cba070ff5738

NCC Group Team9 June 2020

ATTACK:enterprise:S0616 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b59ebb4-4993-4a88-96ed-a25d21382d29

FireEye FiveHands April 2021

ATTACK:enterprise:S0691 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--746c2ff0-e5a1-494f-a9c9-bc45faceb5c5

Microsoft NICKEL December 2021

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a64941e-c585-4ded-b0d7-2d7f3d71eaa8

Mcafee Clop Aug 2019

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e3b8db0-f8bf-4f61-bfc8-b87b5e42a998

Splunk RedLine Stealer June 2023

ATTACK:enterprise:T1614.001 → subtechnique-of → ATTACK:enterprise:T1614

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82909cab-8740-41fd-8ee5-09359d2dd571

ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5cbd480-0147-4e70-9551-03a2b5b8fdcb

Talos Zeus Panda Nov 2017

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab0a634d-8b55-4f66-b800-e4d48ebcd7cc

Socket GlassWorm January 2026

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac01b568-6d51-415f-8dd4-0d148fa204fb

Group IB GrimAgent July 2021

ATTACK:enterprise:S0547 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0b2abea-e4a0-4e96-8e71-9ff49b4759f7

BleepingComputer Molerats Dec 2020

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4e02911-e7de-4561-a20d-56ddfd7eab44

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6bce22a-7318-483d-a7dc-0edf32814ee5

Kaspersky Sodin July 2019

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcf269ba-f79e-4bdf-bbcf-a8313dad7edd

Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024

ATTACK:enterprise:S1200 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be1a4757-08b1-4fdc-95b5-cb3cc57da2d3

Cybereason StealBit Exfiltration Tool

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4902c5f-62a8-4eb7-b86a-fb701ce8fc5f

Avertium Storm-0501 Sabbath Ransomware Arcane January 2022 · Google Mandiant Storm-0501 Sabbath Ransomware November 2021

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf534a00-489d-4980-b647-e4ff020b96d1

Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfed60a3-c288-4c12-bfe2-2c0234a3cfa7

SecureList SynAck Doppelgänging May 2018

ATTACK:enterprise:S0083 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d90f6beb-0936-40ca-b38c-269094d4ed02

Cylance Dust Storm

ATTACK:enterprise:S0546 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbe09d1f-9826-448d-83e0-5712f575fe76

BleepingComputer Molerats Dec 2020

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eac4ee74-494e-41fb-930b-096c5a392e66

Trustwave BlackByte 2021

ATTACK:enterprise:G1026 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f70697d6-11d6-4f1d-81ab-65bbe0d4e80c

SCILabs Malteiro 2021

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--faccdb82-54fb-4d6c-a2ec-7cbfc9e5cc13

Aikido CanisterWorm MAR 2026 · Palo Alto TeamPCP MAR 2026

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.