Swachchhanda Shrawan Poudel
fc716d14f6
new: Arbitrary File Download Via IMEWDBLD.EXE new: Arbitrary File Download Via MSEDGE_PROXY.EXE new: Arbitrary File Download Via Squirrel.EXE - This is a split rule from "45239e6a-b035-4aaf-b339-8ad379fcb67e" new: Msxsl.EXE Execution new: Potential File Download Via MS-AppInstaller Protocol Handler new: Remote XSL Execution Via Msxsl.EXE update: AppX Package Installation Attempts Via AppInstaller.EXE - Update description and title update: Arbitrary File Download Via MSOHTMED.EXE - Update title update: Arbitrary File Download Via PresentationHost.EXE - Update title update: File Download And Execution Via IEExec.EXE - Update title and description update: File Download From Browser Process Via Inline URL - Enhance accuracy by using the "endswith" modifier and incrasing coverage by adding new extensions to the list update: File Download Using ProtocolHandler.exe - Update logic by removing unecessary the "selection_cli_1" update: File Download Via InstallUtil.EXE - Update title and description update: File Download Via Windows Defender MpCmpRun.EXE - Update metadata information and add additional fields to the image selection update: Network Connection Initiated By IMEWDBLD.EXE - Update description and title update: Potentially Suspicious Electron Application CommandLine - Add "msedge_proxy.exe" to list of processes update: Process Proxy Execution Via Squirrel.EXE - Moved the logic that covers the "download" aspect into a new rule "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c" update: Suspicious Calculator Usage - Update filter to remove the "C:" prefix, which increase coverage of other partitions update: Uncommon Child Process Of Appvlp.EXE - Update description, title and enahnce false positives filters update: XBAP Execution From Uncommon Locations Via PresentationHost.EXE - Update title and description update: XSL Script Execution Via WMIC.EXE - Removed the selection that covers "Msxsl" and moved to a seperate rules "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0" --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
27 lines
1.2 KiB
YAML
27 lines
1.2 KiB
YAML
title: Msxsl.EXE Execution
|
|
id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0
|
|
status: test
|
|
description: |
|
|
Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files.
|
|
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
|
|
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
|
|
author: Timur Zinniatullin, oscd.community
|
|
date: 2019/10/21
|
|
modified: 2023/11/09
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.t1220
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
Image|endswith: '\msxsl.exe'
|
|
condition: selection
|
|
falsepositives:
|
|
- Msxsl is not installed by default and is deprecated, so unlikely on most systems.
|
|
# Note: If you levreage this utility please consider adding additional filters. As this is looking for "any" type of execition
|
|
level: medium
|