Extensible Stylesheet Language (XSL) files describe how to process and render XML data. The standard supports embedded scripting in several languages, and that is the opening. MITRE ATT&CK tracks the abuse as T1220, XSL Script Processing, in the Stealth tactic, on Windows.
How attackers use it
Adversaries may embed scripts in XSL files to execute code and possibly bypass application control. MITRE describes two routes.
The first uses msxsl.exe, the Microsoft command line transformation utility. It can run JavaScript embedded in local or remote XSL files. It takes an XML source file and an XSL stylesheet, and because the XSL file is itself valid XML, the same file can be passed twice. Files can also carry an arbitrary extension. Msxsl.exe is not installed by default, so an adversary usually has to bring it along.
The second, dubbed Squiblytwo, uses Windows Management Instrumentation to invoke JScript or VBScript inside an XSL file. It can run local or remote scripts and relies on a trusted, built-in Windows tool.
How to detect it
The MITRE strategy covers execution of XSL scripts through msxsl.exe or wmic.exe with embedded JScript or VBScript. Correlate process creation, command line patterns and module loads of scripting components such as jscript.dll. A copy of msxsl.exe on a machine that never had it is a finding on its own.
How to reduce the risk
If msxsl.exe is unnecessary in your environment, block its execution.
Quick check
Why is msxsl.exe a useful hunting clue?
It is not installed by default, so an adversary typically has to package it. Its presence or execution on a typical endpoint stands out.
Sources
- MITRE ATT&CK, T1220: https://attack.mitre.org/techniques/T1220
