XSL Script Processing T1220
Tactic: Stealth
Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages.
Events covered
4 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 7 | Image loaded |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Authoring guide
These 20 rules share fields, values, and exclusions.
Fields filtered most (27 distinct)
These fields appear most often in rule filters.
Top indicator values (154 distinct)
These values appear most often in rule predicates.
Exclusions (196 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 5 rules
- Msxsl.EXE Execution
- Potential Remote SquiblyTwo Technique Execution
- Remote XSL Execution Via Msxsl.EXE
- WMIC Loading Scripting Libraries
- XSL Script Execution Via WMIC.EXE
Elastic 10 rules
- Delayed Execution via Ping
- Inhibit System Recovery via Signed Binary Proxy
- Managed .NET Code Execution via Windows Script Interpreter
- Network Connection via MsXsl
- Remote XSL Script Execution via COM
- Script Execution via MSXSL
- Suspicious API Call via Windows Script Interpreter
- Suspicious Windows Schedule Child Process
- Suspicious WMIC XSL Script Execution
- Suspicious WMIC XSL Script Execution