attack.t1220

Msxsl.EXE Execution

Apr 28, 2026 · attack.stealth attack.t1220 ·

Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.

Potential Remote SquiblyTwo Technique Execution

Apr 28, 2026 · attack.stealth attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

Remote XSL Execution Via Msxsl.EXE

Apr 28, 2026 · attack.stealth attack.t1220 ·

Share on:

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

WMIC Loading Scripting Libraries

Apr 28, 2026 · attack.stealth attack.t1220 ·

Share on:

Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the /FORMAT argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.

XSL Script Execution Via WMIC.EXE

Apr 28, 2026 · attack.stealth attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.