XSL Script Execution Via WMIC.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Known false positives

WMIC.exe FP depend on scripts and administrative methods used in the monitored environment.
Static format arguments - https://petri.com/command-line-wmi-part-3

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation `T1059.005` Command and Scripting Interpreter: Visual Basic `T1059.007` Command and Scripting Interpreter: JavaScript
Stealth	`T1220` XSL Script Processing

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: XSL Script Execution Via WMIC.EXE
id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
related:
    - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
      type: similar
    - id: 8d63dadf-b91b-4187-87b6-34a1114577ea
      type: similar
status: test
description: |
    Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
    Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
    Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
date: 2019-10-21
modified: 2026-01-24
tags:
    - attack.stealth
    - attack.t1047
    - attack.t1220
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
        - Hashes|contains:  # Sysmon field hashes contains all types
              - 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
              - 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
              - 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
              - 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
              - 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'
    selection_cmd:
        CommandLine|contains|windash: '-format:'     # wmic process list -FORMAT /? or wmic process list /FORMAT /?
    filter_main_known_format:
        CommandLine|contains:
            - 'Format:List'
            - 'Format:htable'
            - 'Format:hform'
            - 'Format:table'
            - 'Format:mof'
            - 'Format:value'
            - 'Format:rawxml'
            - 'Format:xml'
            - 'Format:csv'
    filter_main_remote_operation: # Covered by 8d63dadf-b91b-4187-87b6-34a1114577ea
        CommandLine|contains:
            - '://'
            - '\\\\'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - WMIC.exe FP depend on scripts and administrative methods used in the monitored environment.
    - Static format arguments - https://petri.com/command-line-wmi-part-3
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'
    - Hashes|contains:
          - 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
          - 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
          - 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
          - 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
          - 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'

Stage 2: `selection_cmd`

selection_cmd:
    CommandLine|contains|windash: '-format:'

Stage 3: `not filter_main_*`

filter_main_known_format:
    CommandLine|contains:
        - 'Format:List'
        - 'Format:htable'
        - 'Format:hform'
        - 'Format:table'
        - 'Format:mof'
        - 'Format:value'
        - 'Format:rawxml'
        - 'Format:xml'
        - 'Format:csv'
filter_main_remote_operation:
    CommandLine|contains:
        - '://'
        - '\\\\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`://`	`excludes:CommandLine` `field:"CommandLine" value:"://"`
`CommandLine`	match	`Format:List`	`excludes:CommandLine` `field:"CommandLine" value:"Format:List"`
`CommandLine`	match	`Format:csv`	`excludes:CommandLine` `field:"CommandLine" value:"Format:csv"`
`CommandLine`	match	`Format:hform`	`excludes:CommandLine` `field:"CommandLine" value:"Format:hform"`
`CommandLine`	match	`Format:htable`	`excludes:CommandLine` `field:"CommandLine" value:"Format:htable"`
`CommandLine`	match	`Format:mof`	`excludes:CommandLine` `field:"CommandLine" value:"Format:mof"`
`CommandLine`	match	`Format:rawxml`	`excludes:CommandLine` `field:"CommandLine" value:"Format:rawxml"`
`CommandLine`	match	`Format:table`	`excludes:CommandLine` `field:"CommandLine" value:"Format:table"`
`CommandLine`	match	`Format:value`	`excludes:CommandLine` `field:"CommandLine" value:"Format:value"`
`CommandLine`	match	`Format:xml`	`excludes:CommandLine` `field:"CommandLine" value:"Format:xml"`
`CommandLine`	match	`\\\\`	`excludes:CommandLine` `field:"CommandLine" value:"\\\\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-format:` transforms: `windash`	`field:"CommandLine" kind:match value:"-format:"`
`Hashes`	match	`IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00` corpus 2 (sigma 2) `IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E` corpus 2 (sigma 2) `IMPHASH=37777A96245A3C74EB217308F3546F4C` corpus 2 (sigma 2) `IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206` corpus 2 (sigma 2) `IMPHASH=B12619881D79C3ACADF45E752A58554A` corpus 2 (sigma 2)	`field:"Hashes" kind:match`
`Image`	ends_with	`\wmic.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with value:"\wmic.exe"`
`OriginalFileName`	eq	`wmic.exe` corpus 80 (sigma 38, elastic 24, splunk 18)	`field:"OriginalFileName" kind:eq value:"wmic.exe"`