Detection rules › Splunk
Msxsl Execution (Sysmon)
To support complex operations, the XSL standard includes support for embedded scripting in various languages. Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation utility binary (msxsl.exe) and can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '12575.17928'
title: Msxsl Execution
description: 'To support complex operations, the XSL standard includes support for
embedded scripting in various languages. Adversaries may abuse this functionality
to execute arbitrary files while potentially bypassing application control. Similar
to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation
utility binary (msxsl.exe) and can be installed and used to execute malicious JavaScript
embedded within local or remote (URL referenced) XSL files. Living Off the Land
Binary and Scripts (LOLBAS) (LOLBIN) Atomics T1220 Test #1 Atomics T1220 Test #2 '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
OR Type=Process) ("msxsl.exe") OR ((".xml" ".xsl") OR (".xsl" ".xsl")) | table _time,
host, user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
as * by _time, host | where match(process_name, "(?i)msxsl") OR match(process, "(?i)\S+\.x[ms]l\s+.*\.xsl") '
techniques:
- defense-evasion:xsl script processing
technique_id:
- T1220
data_category:
- Windows Sysmon
references:
- https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<" OR Type=Process) ("msxsl.exe") OR ((".xml" ".xsl") OR (".xsl" ".xsl"))
Stage 2: table
| table _time, host, user process, process_*, signature_id, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where match(process_name, "(?i)msxsl") OR match(process, "(?i)\S+\.x[ms]l\s+.*\.xsl")
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
process | regex_match |
| field:"CommandLine" kind:regex_match |
process_name | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | "msxsl.exe" |
| 1 | ".xml" |
| 1 | ".xsl" |
| 1 | ".xsl" |
| 1 | ".xsl" |