Windows msxsl.exe Execution with HTTP Keyword in Command Line

Flags execution of msxsl.exe when the command line includes an HTTP URL indicator.

FreeUnreviewedSigmahighv1

windows-msxsl-exe-execution-with-http-keyword-in-command-line-75d0a94e

title: Windows msxsl.exe Execution with HTTP Keyword in Command Line
id: a1001bb3-a859-43f3-a548-09c59e8043f1
status: test
description: This rule flags process creation where the executable name ends with \msxsl.exe and the command line contains the keyword "http". Attackers can use msxsl to process remote XSL content, so the presence of "http" in the invocation can indicate remote file retrieval for execution. The detection relies on Windows process creation telemetry with the image path and full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-11-09
tags:
  - attack.stealth
  - attack.t1220
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \msxsl.exe
    CommandLine|contains: http
  condition: selection
falsepositives:
  - Msxsl is not installed by default and is deprecated, so unlikely on most systems.
level: high
license: DRL-1.1
related:
  - id: 75d0a94e-6252-448d-a7be-d953dff527bb
    type: derived

What it detects

This rule flags process creation where the executable name ends with \msxsl.exe and the command line contains the keyword "http". Attackers can use msxsl to process remote XSL content, so the presence of "http" in the invocation can indicate remote file retrieval for execution. The detection relies on Windows process creation telemetry with the image path and full command line.

Known false positives

Msxsl is not installed by default and is deprecated, so unlikely on most systems.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.