Windows Msxsl.exe Execution

Flags execution of the Windows MSXSL utility (msxsl.exe), which can be abused to process attacker-controlled XSL inputs.

FreeUnreviewedSigmamediumv1

windows-msxsl-exe-execution-9e50a8b3

title: Windows Msxsl.exe Execution
id: d934f6e7-f7b9-48fe-9dce-0aef2aa464c2
status: test
description: This rule identifies process creation events where the executed binary ends with \msxsl.exe on Windows. Msxsl is a utility that can process XSL files, and adversaries may use it to load and execute attacker-controlled inputs in ways that can evade some controls. Telemetry relies on Windows process creation logging capturing the executable path or image name.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msxsl_execution.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-11-09
tags:
  - attack.stealth
  - attack.t1220
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \msxsl.exe
  condition: selection
falsepositives:
  - Msxsl is not installed by default and is deprecated, so unlikely on most systems.
level: medium
license: DRL-1.1
related:
  - id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0
    type: derived

What it detects

This rule identifies process creation events where the executed binary ends with \msxsl.exe on Windows. Msxsl is a utility that can process XSL files, and adversaries may use it to load and execute attacker-controlled inputs in ways that can evade some controls. Telemetry relies on Windows process creation logging capturing the executable path or image name.

Known false positives

Msxsl is not installed by default and is deprecated, so unlikely on most systems.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.