Detection rules › Splunk
Msxsl Execution (EDR)
To support complex operations, the XSL standard includes support for embedded scripting in various languages. Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation utility binary (msxsl.exe) and can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1220 XSL Script Processing |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '12575.17925'
title: Msxsl Execution
description: 'To support complex operations, the XSL standard includes support for
embedded scripting in various languages. Adversaries may abuse this functionality
to execute arbitrary files while potentially bypassing application control. Similar
to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation
utility binary (msxsl.exe) and can be installed and used to execute malicious JavaScript
embedded within local or remote (URL referenced) XSL files. Living Off the Land
Binary and Scripts (LOLBAS) (LOLBIN) Atomics T1220 Test #1 Atomics T1220 Test #2 '
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc"))
OR (TERM(ProcessRollup2) OR Type=Process) OR TERM(DeviceProcessEvents)) ("msxsl.exe")
OR ((".xml" ".xsl") OR (".xsl" ".xsl")) | table _time, host, user signature_id,
process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host
| where match(process_name, "(?i)msxsl") OR match(process, "(?i)\S+\.x[ms]l\s+.*\.xsl")
`hec_collect`'
techniques:
- defense-evasion:xsl script processing
technique_id:
- T1220
data_category:
- EDR Logs
- Process command-line parameters
references:
- https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc")) OR (TERM(ProcessRollup2) OR Type=Process) OR TERM(DeviceProcessEvents)) ("msxsl.exe") OR ((".xml" ".xsl") OR (".xsl" ".xsl"))
Stage 2: table
| table _time, host, user signature_id, process, process_*, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where match(process_name, "(?i)msxsl") OR match(process, "(?i)\S+\.x[ms]l\s+.*\.xsl") `hec_collect`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
event_type | in |
|
process | match |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | ProcessRollup2 |
| 1 | TERM |
| 1 | DeviceProcessEvents |
| 1 | "msxsl.exe" |
| 1 | ".xml" |
| 1 | ".xsl" |
| 1 | ".xsl" |
| 1 | ".xsl" |