detection.wiki

Detection rules › Sigma

XSL Script Execution Via WMIC.EXE

Severity
medium
Author
Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
Source
upstream

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1047 Windows Management Instrumentation, T1059.005 Command and Scripting Interpreter: Visual Basic, T1059.007 Command and Scripting Interpreter: JavaScript
Defense EvasionT1220 XSL Script Processing

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Hashes|contains: 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'
Hashes|contains: 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
Hashes|contains: 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
Hashes|contains: 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
Hashes|contains: 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
Image|endswith: '\wmic.exe'
OriginalFileName: wmic.exe

Stage 2: all of selection_cmd

CommandLine|contains: '-format:'

Stage 3: not 1 of filter_main_*

or:
CommandLine|contains: '://'
CommandLine|contains: 'Format:List'
CommandLine|contains: 'Format:csv'
CommandLine|contains: 'Format:hform'
CommandLine|contains: 'Format:htable'
CommandLine|contains: 'Format:mof'
CommandLine|contains: 'Format:rawxml'
CommandLine|contains: 'Format:table'
CommandLine|contains: 'Format:value'
CommandLine|contains: 'Format:xml'
CommandLine|contains: '\\\\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -format:
  • :// corpus 4 (sigma 4)
  • Format:List
  • Format:csv
  • Format:hform
  • Format:htable
  • Format:mof
  • Format:rawxml
  • Format:table
  • Format:value
  • Format:xml
  • \\\\ corpus 7 (sigma 7)
Hashesmatch
  • IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 corpus 2 (sigma 2)
  • IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E corpus 2 (sigma 2)
  • IMPHASH=37777A96245A3C74EB217308F3546F4C corpus 2 (sigma 2)
  • IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 corpus 2 (sigma 2)
  • IMPHASH=B12619881D79C3ACADF45E752A58554A corpus 2 (sigma 2)
Imageends_with
  • \wmic.exe corpus 37 (sigma 37)
OriginalFileNameeq
  • wmic.exe corpus 33 (sigma 33)