T1220 — XSL Script Processing

Tactic: Stealth · Platforms: Windows

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes…

Sigma detection rules (1)

T1220 XSL Script Processing

title: T1220 XSL Script Processing
id: 64ba3e37-d9c1-4bfa-a935-0e65b0c55c4b
description: 'Detect XSL Script Abuse via msxsl and wmic. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CommandLinePattern, ParentProcess, TimeWindow, RemoteXSLDomainWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1220
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.stealth
  - attack.t1220

logsource:
  category: process_creation
  product: windows

detection:
  selection_msxsl:
    EventID: '1'
    Image|endswith: '\msxsl.exe'
  selection_wmic_xsl:
    EventID: '1'
    Image|endswith: '\wmic.exe'
    CommandLine|contains: '/FORMAT:'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_msxsl or selection_wmic_xsl) and not filter_system_account

falsepositives:
  - Legitimate use of msxsl.exe for XSLT transformations, or wmic /FORMAT: with a local, non-remote XSL stylesheet.

level: medium

Explore