{"id":8439,"date":"2023-03-10T23:47:21","date_gmt":"2023-03-10T23:47:21","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=8439"},"modified":"2023-03-10T23:47:21","modified_gmt":"2023-03-10T23:47:21","slug":"threat-hunting-localization-issues","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2023\/03\/10\/threat-hunting-localization-issues\/","title":{"rendered":"Threat Hunting &#8211; localization issues"},"content":{"rendered":"\n<p>So you finished writing your perfect threat hunting query. <\/p>\n\n\n\n<p>Done and dusted, right?<\/p>\n\n\n\n<p>Hmm, sorry&#8230; chances are, it is&#8230; broken.<\/p>\n\n\n\n<p>How come? <\/p>\n\n\n\n<p>One reason, but it has many acronyms: L10N, T9N, I18N or G11N.<\/p>\n\n\n\n<p>If you are mostly dealing with English-centric versions of the operating systems you may now stop reading. But&#8230; You will be missing out.<\/p>\n\n\n\n<p>Why? <\/p>\n\n\n\n<p>THERE ARE OTHER LANGUAGES OUT THERE. And they come with a luggage&#8230;<\/p>\n\n\n\n<p>The acronyms listed earlier expand into:<\/p>\n\n\n\n<ul><li>Translation (T9N)<\/li><li>Localization (L10N)<\/li><li>Internationalization (I18N)<\/li><li>Globalization (G11N)\u00a0<\/li><\/ul>\n\n\n\n<p>They define a different world. The world that is quite esoteric to monoglots. The world that embraces the world of &#8216;other languages in use&#8217;. The whole lot of new devices &#8216;suddenly in scope&#8217;, too. The world of foreigners who do not use English as their MAIN language. Most of Europe really. Many places in the world, REALLY!<\/p>\n\n\n\n<p>In this world, your c:\\Program Files becomes&#8230; an item from this <a href=\"https:\/\/en.wikipedia.org\/wiki\/Program_Files\">table<\/a>.<\/p>\n\n\n\n<p>Pfff&#8230; and suddenly, all your queries relying on hard-coded &#8216;program files&#8217; string need to be adjusted. <\/p>\n\n\n\n<p>You are welcome! \ud83d\ude42<\/p>\n\n\n\n<p>And it&#8217;s not the only artifact that changes. <\/p>\n\n\n\n<p>What about &#8216;New folder&#8221;? This <a href=\"https:\/\/www.devmedia.com.br\/forum\/traducao-dos-botoes\/555742\">thread<\/a> shows some examples of &#8220;New Folder&#8221; string represented in various languages:<\/p>\n\n\n\n<ul><li>Neuer Ordner<\/li><li>New folder<\/li><li>Nouveau dossier<\/li><li>Nova Pasta<\/li><li>Nowy folder<\/li><li>Nuova Cartella<\/li><\/ul>\n\n\n\n<p>And again, this is just one of many &#8216;not so subtle&#8217; localization changes to the OS that affects the way you should be writing your threat hunting queries or doing your DFIR engagement. And yes, it complicates things A LOT. And yes, Hebrew, Arabic, Chinese and Japanese versions of these do exist as well, and they complicate things even more.<\/p>\n\n\n\n<p>Where does it leave us?<\/p>\n\n\n\n<p>Simple answer: pay attention. More responsible answer: explore the environment &amp; adjust queries as per need. <\/p>\n\n\n\n<p>As long as your results generating framework\/language supports Unicode you should be seeing these localized &#8220;things&#8221;, but only IF YOU EXPECT THEM. Once you see them, bundle them together and use them as a template, f.ex. use combos like this for a c:\\program files folder name:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\"\\Program Files\",\n\"\\Programme\",\n\"\\Archivos de programa\",\n\"\\Programmes\",\n\"\\Programmi\",\n\"\\Arquivos de Programas\",\n\"\\Programmer\",\n\"\\Programfiler\",\n\"\\Fisiere Program\"<\/pre>\n\n\n\n<p>These are not all the possibilities, of course, but they are good enough to make us all &#8216;aware&#8217;. <\/p>\n\n\n\n<p>Going forward, we will all be localizing our queries. Oui?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So you finished writing your perfect threat hunting query. Done and dusted, right? Hmm, sorry&#8230; chances are, it is&#8230; broken. How come? One reason, but it has many acronyms: L10N, T9N, I18N or G11N. If you are mostly dealing with &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2023\/03\/10\/threat-hunting-localization-issues\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[79],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8439"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=8439"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8439\/revisions"}],"predecessor-version":[{"id":8441,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8439\/revisions\/8441"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=8439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=8439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=8439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}