T1220Stealth
XSL Script Processing
Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. Adversaries may abuse this functionality to…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
5 Sigma rules tagged T1220XSL Script ProcessingT12205 general rules
- Potential Remote SquiblyTwo Technique Executionhightest
- Remote XSL Execution Via Msxsl.EXEhightest
- Msxsl.EXE Executionmediumtest
- WMIC Loading Scripting Librariesmediumtest
- XSL Script Execution Via WMIC.EXEmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to XSL Script Processing
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.