Windows msxsl.exe Execution with HTTP Keyword in Command Line
Flags execution of msxsl.exe when the command line includes an HTTP URL indicator.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2023-11-09
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where the executable name ends with \msxsl.exe and the command line contains the keyword "http". Attackers can use msxsl to process remote XSL content, so the presence of "http" in the invocation can indicate remote file retrieval for execution. The detection relies on Windows process creation telemetry with the image path and full command line.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows msxsl.exe Execution with HTTP Keyword in Command Line
id: a1001bb3-a859-43f3-a548-09c59e8043f1
status: test
description: This rule flags process creation where the executable name ends with \msxsl.exe and the command line contains the keyword "http". Attackers can use msxsl to process remote XSL content, so the presence of "http" in the invocation can indicate remote file retrieval for execution. The detection relies on Windows process creation telemetry with the image path and full command line.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-11-09
tags:
- attack.stealth
- attack.t1220
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \msxsl.exe
CommandLine|contains: http
condition: selection
falsepositives:
- Msxsl is not installed by default and is deprecated, so unlikely on most systems.
level: high
license: DRL-1.1
related:
- id: 75d0a94e-6252-448d-a7be-d953dff527bb
type: derived