XSL stylesheet transform executed via msxsl or wmic format switch

Siemphony@siemphonymediumT1220verified in lab

AN0581 covers proxy execution of embedded JScript/VBScript through XSL transforms and names two paths: the standalone msxsl.exe utility, and wmic.exe's built-in /format: switch pointed at an .xsl stylesheet — the Squiblytwo variant of the same abuse. msxsl.exe is not shipped with Windows at all, so its mere presence and execution is the whole signal; the selection gates on the binary name alone. wmic.exe does ship with Windows and has a legitimate output-formatting feature built on the same XSL engine, so that selection additionally requires the command line to reference both the /format switch and an .xsl target — narrowing to the abuse pattern rather than every wmic invocation. The brief's second log source, Sysmon EventID 7 module load of jscript.dll, is not used here. It would only strengthen this same detection by confirming the script engine actually loaded — a correlation between a process-creation event and a later module-load event in the same process, which lib/sigma has no join or timeframe to express. Taken alone, an image-load selection on jscript.dll would fire on ordinary Internet Explorer/WSH/HTA activity and add nothing MITRE's `TimeWindow` knob wasn't already describing as needing correlation. MITRE's `CommandLinePattern` knob is populated here only with the literal .xsl extension; an adversary renaming the stylesheet to .jpeg or another extension, as the knob's own description anticipates, defeats this rule entirely, and MITRE's `RemoteXSLDomainWhitelist` knob (filtering known-safe remote XSL URLs) is not implemented — this rule alerts on local and remote XSL targets alike. Prerequisite: this logic depends on Sysmon being deployed with EventID 1 enabled and command-line logging in the config, which is not a Windows default; without Sysmon this returns zero rows, and zero rows here means no sensor rather than no activity. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0205, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\msxsl.exe" or (FolderPath endswith "\\wmic.exe" and (ProcessCommandLine contains "format" and ProcessCommandLine contains ".xsl")))

Splunk · SPL

Run this as a search.

index=* (Image="*\\msxsl.exe" OR (Image="*\\wmic.exe" AND (CommandLine="*format*" AND CommandLine="*.xsl*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\msxsl.exe" OR (TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" AND (TO_LOWER(process.command_line) LIKE "*format*" AND TO_LOWER(process.command_line) LIKE "*.xsl*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\msxsl\.exe$</field>    <description>XSL stylesheet transform executed via msxsl or wmic format switch (1/2)</description>    <mitre>      <id>T1220</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\wmic\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:format))(?=.*(?:\.xsl)).*</field>    <description>XSL stylesheet transform executed via msxsl or wmic format switch (2/2)</description>    <mitre>      <id>T1220</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 159f32b6-fb61-44d1-9597-a39dfeac9cf3

ATT&CKT1220

T1220XSL Script Processing

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

XSL Script Processing (T1220): an adversary uses the XSL transform engine built into Windows to run embedded JScript or VBScript, sidestepping controls that watch for scripting hosts directly. The rule covers two execution paths from MITRE's AN0581: the standalone msxsl.exe utility, and wmic.exe's built-in /format: switch pointed at a malicious .xsl stylesheet — the "Squiblytwo" variant of the same trick.

02 · Telemetry you need

Sysmon EventID 1 (process creation) with command-line logging enabled in the Sysmon config — this is not a Windows default. Without it the rule returns zero rows, and that silence means no sensor, not no activity.

03 · How the logic works

Two independent selections, joined with 1 of selection* so either alone fires the rule. selection_msxsl gates on Image|endswith: '\msxsl.exe' with no other condition. msxsl.exe does not ship with Windows at all, so its mere presence and execution is the entire signal — no command-line narrowing is needed or attempted. selection_wmic_xsl gates on Image|endswith: '\wmic.exe' plus CommandLine|contains|all: ['format', '.xsl']. wmic.exe does ship with Windows and has a legitimate XSL-based output formatter, so the rule requires both substrings to appear on the command line before it counts wmic as suspicious, narrowing away from every ordinary wmic invocation. The brief's second log source for AN0581 — Sysmon EventID 7 module load of jscript.dll — is deliberately not used. It would only strengthen this by confirming the script engine actually loaded, but that is a correlation between a process-creation event and a later module-load event in the same process, and lib/sigma has no join or timeframe to express it. An image-load selection on jscript.dll alone would fire on ordinary Internet Explorer, WSH, or HTA activity and add nothing.

04 · Common false positives

The rule names two honest false positives. First, administrative or reporting scripts that use wmic's own shipped .xsl output formatters — a command like wmic process list /format:hform.xsl is a real, if dated, scripting pattern in some estates and matches the wmic selection exactly, since format and .xsl both appear regardless of whether the target file is Microsoft's own template. Second, legacy line-of-business software bundling msxsl.exe as a redistributable for XML/XSLT report generation, data export, or EDI processing — this was Microsoft's own recommended path before XslCompiledTransform, and some older installers still carry it, so the msxsl selection can fire on entirely sanctioned automation. level: medium reflects that neither leg is rare in every estate, just rare in most.
A reviewer flagged one precision gap that is not yet fixed in the shipped rule: selection_wmic_xsl uses CommandLine|contains|all on the bare word "format" rather than the literal switch token /format:, so a wmic command containing "format" anywhere (a WQL clause, an unrelated argument) alongside .xsl anywhere else on the line would also match, with no positional link between the two substrings.

05 · Detection maturity

tier_1: This rule has never been run against a log line. It sits at the lowest DeBMM maturity tier — authored, not validated — until it has fired against real Sysmon data and its false-positive rate has been observed rather than guessed.

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Tighten selection_wmic_xsl to CommandLine|contains: '/format:' (and its windash variant -format:) instead of the loose word "format", per the review finding. Consider adding MITRE's RemoteXSLDomainWhitelist knob — not implemented here — to suppress known-safe remote XSL sources if your environment references any. The .xsl extension check is also brittle: MITRE's own CommandLinePattern knob notes that renaming the stylesheet defeats detection entirely, so pair this with file-extension-agnostic monitoring if that risk matters to you.

Declared by the author

Administrative or reporting scripts that use wmic's built-in HTML output formatters, such as wmic process list /format:hform.xsl or /format:htable.xsl, which are the shipped .xsl transforms under %windir%\System32\wbem\en-us and are a real, if dated, scripting pattern in some estates.
Legacy line-of-business software that bundles msxsl.exe as a redistributable to perform XML/XSLT transforms as part of report generation, data export or EDI processing — msxsl.exe was Microsoft's own recommended redistributable for this before .NET's XslCompiledTransform, and some older enterprise installers still carry it.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — XSL stylesheet transform executed through wmic
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1220, evaluated against their process_creation events.

Share this rule

/u/siemphony/159f32b6-fb61-44d1-9597-a39dfeac9cf3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

XSL stylesheet transform executed via msxsl or wmic format switch

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it