T1220 XSL Script Processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. MITRE ATT&CK

4 programs on CmdID 4 Sigma rules T1220 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highPotential Remote SquiblyTwo Technique ExecutionMarkus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highRemote XSL Execution Via Msxsl.EXESwachchhanda Shrawan Poudel · Windows

mediumMsxsl.EXE ExecutionTimur Zinniatullin, oscd.community · Windows

mediumXSL Script Execution Via WMIC.EXETimur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel · Windows