Windows Msxsl.exe Execution
Flags execution of the Windows MSXSL utility (msxsl.exe), which can be abused to process attacker-controlled XSL inputs.
- Product
- windows
- Category
- process_creation
- Author
- Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-21
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where the executed binary ends with \msxsl.exe on Windows. Msxsl is a utility that can process XSL files, and adversaries may use it to load and execute attacker-controlled inputs in ways that can evade some controls. Telemetry relies on Windows process creation logging capturing the executable path or image name.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msxsl_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Msxsl.exe Execution
id: d934f6e7-f7b9-48fe-9dce-0aef2aa464c2
status: test
description: This rule identifies process creation events where the executed binary ends with \msxsl.exe on Windows. Msxsl is a utility that can process XSL files, and adversaries may use it to load and execute attacker-controlled inputs in ways that can evade some controls. Telemetry relies on Windows process creation logging capturing the executable path or image name.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msxsl_execution.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-11-09
tags:
- attack.stealth
- attack.t1220
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \msxsl.exe
condition: selection
falsepositives:
- Msxsl is not installed by default and is deprecated, so unlikely on most systems.
level: medium
license: DRL-1.1
related:
- id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0
type: derived