{"id":"T1220","name":"XSL Script Processing","url":"https://attack.mitre.org/techniques/T1220","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0205","stix_id":"x-mitre-detection-strategy--4994627c-216b-4832-90cf-074d3e9013e4","name":"Detect XSL Script Abuse via msxsl and wmic","url":"https://attack.mitre.org/detectionstrategies/DET0205","analytics":[{"id":"AN0581","stix_id":"x-mitre-analytic--f313053f-5898-4f47-b263-a60098f5c963","name":"Analytic 0581","description":"Execution of XSL scripts via msxsl.exe or wmic.exe using embedded JScript or VBScript for proxy execution. Detection correlates process creation, command-line patterns, and module load behavior of scripting components (e.g., jscript.dll).","url":"https://attack.mitre.org/detectionstrategies/DET0205#AN0581","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"CommandLinePattern","description":"May need to tune based on encoded input or custom extensions (e.g., .jpeg instead of .xsl)."},{"field":"ParentProcess","description":"Legitimate administrative or developer tools may use msxsl; validate the parent process chain."},{"field":"TimeWindow","description":"Temporal correlation window between script engine DLL load and suspicious process spawn."},{"field":"RemoteXSLDomainWhitelist","description":"Filter known safe URLs used by enterprise for XSL transformations."}],"live":true,"detection_strategies":["DET0205"],"techniques":["T1220"]}],"live":true,"version":"1.0","techniques":["T1220"]}],"sigma_rules":[{"id":"05c36dd6-79d6-4a9a-97da-3db20298ab2d","title":"XSL Script Execution Via WMIC.EXE","author":"Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2019-10-21","modified":"2026-01-24","description":"Detects the execution of WMIC with the \"format\" flag to potentially load local XSL files.\nAdversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.\nExtensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"06ce37c2-61ab-4f05-9ff5-b1a96d18ae32","title":"WMIC Loading Scripting Libraries","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-10-17","modified":"2022-10-13","description":"Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).\nIt could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.\n","references":["https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html","https://twitter.com/dez_/status/986614411711442944","https://lolbas-project.github.io/lolbas/Binaries/Wmic/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.stealth","attack.t1220"],"path":"rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml","techniques":["T1220"],"cves":[]},{"id":"75d0a94e-6252-448d-a7be-d953dff527bb","title":"Remote XSL Execution Via Msxsl.EXE","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-11-09","modified":null,"description":"Detects the execution of the \"msxsl\" binary with an \"http\" keyword in the command line. This might indicate a potential remote execution of XSL files.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1220"],"path":"rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml","techniques":["T1220"],"cves":[]},{"id":"8d63dadf-b91b-4187-87b6-34a1114577ea","title":"Potential Remote SquiblyTwo Technique Execution","author":"Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-01-16","modified":"2026-01-24","description":"Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)\nto execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process\nmalicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.\nThe attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it\nwith full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common\nLOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.\n","references":["https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html","https://twitter.com/mattifestation/status/986280382042595328","https://atomicredteam.io/defense-evasion/T1220/","https://lolbas-project.github.io/lolbas/Binaries/Wmic/","https://x.com/byrne_emmy12099/status/1932346420226658668"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0","title":"Msxsl.EXE Execution","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2019-10-21","modified":"2023-11-09","description":"Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files.\nAdversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1220"],"path":"rules/windows/process_creation/proc_creation_win_msxsl_execution.yml","techniques":["T1220"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}