Remote XSL Execution Via Msxsl.EXE

Severity: high
Author: Swachchhanda Shrawan Poudel
Source: upstream

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1220` XSL Script Processing

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection`

CommandLine|contains: http
Image|endswith: '\msxsl.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`http` corpus 31 (sigma 31)
`Image`	ends_with	`\msxsl.exe` corpus 7 (sigma 7)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.

Msxsl.EXE Execution [sigma] (drops 1 filter this rule applies)