Windows file events: Suspicious WinRM VBScript use of WsmPty.xsl or WsmTxt.xsl outside system folders

Alert on WsmPty.xsl/WsmTxt.xsl files written outside System32 and SysWOW64, consistent with WinRM VBScript misuse.

FreeUnreviewedSigmamediumv1

windows-file-events-suspicious-winrm-vbscript-use-of-wsmpty-xsl-or-wsmtxt-xsl-ou-d353dac0

title: "Windows file events: Suspicious WinRM VBScript use of WsmPty.xsl or WsmTxt.xsl outside system folders"
id: 5152038c-f9c6-4eec-b552-ad3dd47a9c3a
related:
  - id: 074e0ded-6ced-4ebd-8b4d-53f55908119d
    type: derived
  - id: d353dac0-1b41-46c2-820c-d7d2561fc6ed
    type: derived
status: test
description: This rule flags file creation or modification of attacker-controlled WsmPty.xsl or WsmTxt.xsl when the target path is not within the standard Windows System32 or SysWOW64 directories. Attackers may place these XSL files outside protected system locations to facilitate an application-whitelisting or WinRM-related execution path. Detection relies on Windows file event telemetry that includes the target filename and full path.
references:
  - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_winrm_awl_bypass.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-11-28
tags:
  - attack.stealth
  - attack.t1216
logsource:
  product: windows
  category: file_event
detection:
  system_files:
    TargetFilename|endswith:
      - WsmPty.xsl
      - WsmTxt.xsl
  in_system_folder:
    TargetFilename|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  condition: system_files and not in_system_folder
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1

What it detects

This rule flags file creation or modification of attacker-controlled WsmPty.xsl or WsmTxt.xsl when the target path is not within the standard Windows System32 or SysWOW64 directories. Attackers may place these XSL files outside protected system locations to facilitate an application-whitelisting or WinRM-related execution path. Detection relies on Windows file event telemetry that includes the target filename and full path.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.