diff --git a/host-interaction/hardware/keyboard/layout/get-keyboard-layout.yml b/host-interaction/hardware/keyboard/get-keyboard-layout.yml
similarity index 77%
rename from host-interaction/hardware/keyboard/layout/get-keyboard-layout.yml
rename to host-interaction/hardware/keyboard/get-keyboard-layout.yml
index 49ba7e25..8c2f18a6 100644
--- a/host-interaction/hardware/keyboard/layout/get-keyboard-layout.yml
+++ b/host-interaction/hardware/keyboard/get-keyboard-layout.yml
@@ -1,11 +1,11 @@
 rule:
   meta:
     name: get keyboard layout
-    namespace: host-interaction/hardware/keyboard/layout
+    namespace: host-interaction/hardware/keyboard
     author: michael.hunhoff@mandiant.com
     scope: function
     att&ck:
-      - Discovery::System Information Discovery [T1082]
+      - Discovery::System Location Discovery::System Language Discovery [T1614.001]
     examples:
       - 6F99A2C8944CB02FF28C6F9CED59B161:0x4193C0
       - C91887D861D9BD4A5872249B641BC9F9:0x4015FD
diff --git a/targeting/language/identify-system-language-via-api.yml b/targeting/language/identify-system-language-via-api.yml
new file mode 100644
index 00000000..ba0b9520
--- /dev/null
+++ b/targeting/language/identify-system-language-via-api.yml
@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: identify system language via API
+    namespace: targeting/language
+    author: william.ballenthin@mandiant.com
+    scope: function
+    att&ck:
+      - Discovery::System Location Discovery::System Language Discovery [T1614.001]
+    examples:
+      - 9b7ccaa2ae6a5b96e3110ebcbc4311f6:0x10001F96
+  features:
+    - or:
+      - api: GetUserDefaultUILanguage
+      - api: GetSystemDefaultUILanguage
+      - api: GetUserDefaultLangID