Remote XSL Execution Via Msxsl.EXE

Title: Remote XSL Execution Via Msxsl.EXE
Status: test
Description:Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
Author: Swachchhanda Shrawan Poudel
Date: 2023-11-09
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1220'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\msxsl.exe'
    CommandLine|contains: 'http'
  condition:selection
Falsepositives:
  -Msxsl is not installed by default and is deprecated, so unlikely on most systems.
Level: high