Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. [1]
Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation utility binary (msxsl.exe) [2] can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. [3] Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. [4] Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.[5]
Another variation of this technique, dubbed “Squiblytwo”, involves using Windows Management Instrumentation to invoke JScript or VBScript within an XSL file.[8] This technique can also execute local/remote scripts and, similar to its Regsvr32/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch.[9]
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect XSL Script Abuse via msxsl and wmic
Enterprise
1 platform
AN0581 · Windows
Execution of XSL scripts via msxsl.exe or wmic.exe using embedded JScript or VBScript for proxy execution. Detection correlates process creation, command-line patterns, and module load behavior of scripting components (e.g., jscript.dll).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.
Tests4Executorscommand_prompt 4Need elevation0 of 4Have prerequisites4Have cleanup2Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
MSXSL Bypass using local files
windows
command_prompt
—
3
Yes
Executes the code specified within a XSL script tag during XSL transformation using a local payload.
Requires download of MSXSL. No longer available from Microsoft.
(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 )
Open Calculator.exe when test successfully executed, while AV turned off.
Inputs
Name
Description
Type
Default Value
xmlfile
Location of the test XML file on the local filesystem.
path
PathToAtomicsFolder\T1220\src\msxslxmlfile.xml
xslfile
Location of the test XSL script file on the local filesystem.
path
PathToAtomicsFolder\T1220\src\msxslscript.xsl
msxsl_exe
Location of the MSXSL executable.
path
PathToAtomicsFolder\..\ExternalPayloads\msxsl.exe
Attack Commandsrun with command_prompt
"#{msxsl_exe}" "#{xmlfile}" "#{xslfile}"
Cleanup Commands
del "#{msxsl_exe}" >nul 2>&1
Dependenciesrun with powershell
Description
XML file must exist on disk at specified location (#{xmlfile})
Check Prereq Commands
if (Test-Path "#{xmlfile}") {exit 0} else {exit 1}
Executes the code specified within a XSL script tag during XSL transformation using a remote payload.
Requires download of MSXSL.exe. No longer available from Microsoft.
(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 )
Open Calculator.exe when test successfully executed, while AV turned off.
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). (...)