T1220
XSL Script Processing
Windows1 piece on this siteT1220 on attack.mitre.org
Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages.
Read
Analyses, case studies, guides, references and interview questions.
False-Positive Hall of Fame No. 1: six alerts that were the software working
Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.
how MITRE says to see it
Detect XSL Script Abuse via msxsl and wmic
- Execution of XSL scripts via msxsl.exe or wmic.exe using embedded JScript or VBScript for proxy execution. Detection correlates process creation, command-line patterns, and module load behavior of scripting components (e.g., jscript.dll).
what reduces it
- M1038 Execution Prevention. If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.