Suspicious Execution of Msxsl.EXE (via process_creation)

title: Suspicious Execution of Msxsl.EXE (via process_creation)
id: 39170983-9df8-541b-95b6-20055dc1c274
status: stable
description: This rule detects the execution of the MSXSL utility. This can be leveraged to execute Extensible Stylesheet Language (XSL) files. These files are frequently used to describe the processing and rendering of data within XML files. Adversaries can misuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
references:
    - https://attack.mitre.org/techniques/T1220/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
author: Huntrule Team
date: 2026-07-11
tags:
    - attack.stealth
    - attack.t1220
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\msxsl.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium