Question Analysis
Using Linux process or syslog logs, identify the executable that was run to output the system's locale information.
837d609b-845e-4519-90ce-edc3b4b0e138
Question ID
10/16
Models Correct
1
Valid Answer
63%
Success Rate
Reference Answer
Human-validated correct answer for this question
locale
Model Performance Comparison
See how different AI models performed on this question
| Model | Answer | KQL Query | Status | Attempts | Time | Cost |
|---|---|---|---|---|---|---|
| gemini-2.5-flash-preview-04-17 | locale | DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine has_any ("locale", "localectl", "env ") or ProcessCommandLine contains " grep locale"
| project Timestamp, DeviceName, FileName, ProcessCommandLine | Correct | 1 | 9.74s | 0.0065 |
| gpt-35-turbo | locale | DeviceProcessEvents | where ProcessCommandLine contains 'locale' | project ProcessId, FileName, ProcessCommandLine | Correct | 1 | 1.86s | 0.0035 |
| gpt-4-turbo-2024-04-09 | locale | DeviceProcessEvents
| where ProcessCommandLine has 'locale'
| project DeviceName, FileName, ProcessCommandLine, TimeGenerated | Correct | 1 | 9.72s | 0.0741 |
| gpt-4.1 | locale | DeviceProcessEvents
| where FileName in~ ('locale', 'localectl') or ProcessCommandLine has_any ('locale', 'localectl', '/etc/locale.conf')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath
| order by TimeGenerated desc | Correct | 1 | 5.94s | 0.0172 |
| gpt-4.1-finetuned | /usr/bin/locale, /usr/bin/localectl, /usr/bin/cat, /usr/bin/dash, /usr/bin/locale-check, /usr/sbin/runuser, /usr/bin/curl | DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("locale", "localectl", "/etc/default/locale", "/etc/locale.conf", "/etc/sysconfig/i18n")
| summarize count() by FolderPath, ProcessCommandLine
| order by count_ desc
| extend MITRE_Technique = "T1033"
| extend MITRE_TechniqueName = "System Owner/User Discovery"
| extend MITRE_IDs_URL = "https://attack.mitre.org/techniques/T1033/"
| extend MITRE_Technique_URL = "https://attack.mitre.org/techniques/T1033/"
| Correct | 1 | 580.68s | 0.0176 |
| gpt-4.1-mini | locale | union DeviceProcessEvents, DeviceEvents
| where ProcessCommandLine has_any ("locale", "localectl", "echo $LANG") or ActionType has_any ("locale", "localectl", "echo $LANG")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, ActionType
| sort by TimeGenerated desc | Correct | 1 | 3.46s | 0.0033 |
| gpt-4.1-nano | dash | DeviceProcessEvents
| where ProcessCommandLine contains 'localectl' or ProcessCommandLine contains 'locale' or ProcessCommandLine contains 'echo $LANG' or ProcessCommandLine contains 'echo $LC_ALL'
| project InitiatingProcessFileName, ProcessCommandLine, TimeGenerated, DeviceName | Incorrect | 4 | 6.36s | 0.0017 |
| gpt-4o | dash | DeviceProcessEvents
| where InitiatingProcessCommandLine contains "locale"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessCreationTime | Incorrect | 1 | 17.60s | 0.0149 |
| grok-3-beta | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0873 |
| grok-3-mini-beta | locale | DeviceProcessEvents
| where ProcessCommandLine contains "locale"
| project FileName, ProcessCommandLine, Timestamp
| order by Timestamp desc | Correct | 1 | 11.65s | 0.0023 |
| o1-high | locale | DeviceInfo
| where OSPlatform == "Linux"
| project DeviceId
| join kind=inner (
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where (FileName in~ ("locale", "localectl", "cat") or (FileName == "env" and ProcessCommandLine has "LANG="))
| where ProcessCommandLine has_any ("locale", "localectl", "LANG=", "/etc/locale.conf")
| project TimeGenerated, DeviceId, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
) on DeviceId
| Correct | 2 | 39.86s | 0.3361 |
| o1-low | locale | DeviceInfo
| where OSPlatform == "Linux"
| distinct DeviceId
| join kind=inner (
DeviceProcessEvents
| where FileName in~ ("locale", "localectl") or ProcessCommandLine has_any ("locale", "localectl")
) on DeviceId
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine | Correct | 2 | 44.33s | 0.4338 |
| o3-mini-high | locale | DeviceProcessEvents
| where ProcessCommandLine contains "locale"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine
| top 100 by TimeGenerated desc | Correct | 1 | 22.75s | 0.0152 |
| o3-mini-low | dash | DeviceProcessEvents
| where InitiatingProcessCommandLine contains "locale"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime
| sort by ProcessCreationTime desc | Incorrect | 1 | 12.23s | 0.0125 |
| o4-mini-high | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0483 |
| o4-mini-low | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0505 |