XSL stylesheets are meant to transform XML, but the XSL standard as implemented on Windows allows embedded script, so a stylesheet can carry JScript or VBScript that a trusted transformation tool will run. MITRE ATT&CK T1220 XSL Script Processing covers adversaries embedding scripts in XSL files to "bypass application control and obscure execution of code". In ATT&CK v20 it is a Stealth (TA0005) technique on Windows with no sub-techniques. Two tools carry it: Microsoft's command-line transformation utility msxsl.exe, which is not installed by default and so is usually dropped by the attacker, and WMIC's /FORMAT switch, a variant ATT&CK notes is dubbed "Squiblytwo". This guide covers the recorded procedures, the v20 detection strategy, the block rules and the WMIC removal that now shrink the attack surface, and how to test. It is for detection engineers and endpoint owners. The general living-off-the-land picture is in the Living off the Land Guide.
Key takeaways
- Two carriers, two different fixes. msxsl.exe arrives with the attacker, so application control that blocks unknown or listed executables stops it; WMIC is a Windows component that Microsoft has deprecated and is removing.
- The file extension proves nothing. ATT&CK notes the XSL file can be passed twice and given any extension, including
.jpeg. - Script engine loads are the tell. ATT&CK's analytic AN0581 correlates msxsl.exe or wmic.exe process creation with module loads of scripting components such as
jscript.dll. - Remote stylesheets mean network activity from odd processes. Both msxsl and WMIC can fetch a stylesheet by URL, which Astaroth and Lazarus Group have done.
- Developers have a related setting. In .NET,
XsltSettings.EnableScriptdefaults to false and is now marked obsolete; applications that transform untrusted XSL should never turn it on.
How the technique works
ATT&CK explains that XSL files describe the processing and rendering of XML data and that "the XSL standard includes support for embedded scripting in various languages". An adversary supplies a stylesheet containing a script block; a transformation engine processes it and runs the script inside a trusted process. Like T1218 System Binary Proxy Execution, the goal is to have a trusted or signed tool execute the code. ATT&CK compares it to T1127 Trusted Developer Utilities Proxy Execution for msxsl.exe and to Regsvr32 (T1218.010) "Squiblydoo" for the WMIC variant.
| Carrier | Present by default? | How ATT&CK describes abuse | Main control |
|---|---|---|---|
msxsl.exe | No; the adversary "will likely need to package it with dropped files" | Takes an XML source and an XSL stylesheet, both of which can be the same file with an arbitrary extension, local or by URL | Block execution (M1038); application control that denies unapproved executables |
wmic.exe with /FORMAT | Historically yes; see the WMIC status section below | Any WMIC alias with the /FORMAT switch pointing to a local or remote XSL file runs its JScript or VBScript | Microsoft recommended block rules (deny wmic.exe, all versions); WMIC removal |
WMIC itself is a management interface covered in the T1047 Windows Management Instrumentation Defensive Guide; T1220 concerns only its stylesheet processing. Signed Windows scripts used the same way are covered in the T1216 System Script Proxy Execution guide.
How adversaries use it
v20 records four procedure examples, attributed as follows.
| Actor or software | What ATT&CK records | Defensive lesson |
|---|---|---|
| Cobalt Group | Used msxsl.exe to bypass AppLocker and invoke JScript code from an XSL file | Path-based AppLocker rules that allow user-writable locations or unknown signed tools do not stop a dropped msxsl.exe |
| Astaroth | Executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain | Watch for transformation tools making network connections |
| Lazarus Group (Operation Dream Job, C0022) | Used a remote XSL script to download a Base64-encoded DLL custom downloader | XSL processing is often a stage in a longer chain; correlate with the decode and DLL load that follow. See the Lazarus Group Threat Actor Profile |
| Higaisa | Used an XSL file to run VBScript code | VBScript inside XSL is caught by the same script engine telemetry as other VBScript |
The Operation Dream Job chain shows how T1220 links to T1105 Ingress Tool Transfer and to decoding of the Base64 payload, which ATT&CK tracks separately as T1140 Deobfuscate/Decode Files or Information.
What to detect and where
ATT&CK v20 detection strategy DET0205, "Detect XSL Script Abuse via msxsl and wmic", has one Windows analytic, AN0581: execution of XSL scripts via msxsl.exe or wmic.exe with embedded JScript or VBScript, correlating process creation, command-line patterns and module loads of scripting components. Its data components are Process Creation (Sysmon event 1) and Module Load (Sysmon event 7).
| Signal | Telemetry | Why it matters |
|---|---|---|
| Any execution of a binary whose OriginalFileName is msxsl.exe | Sysmon 1 or EDR process events | Not present by default, so almost every execution on a user device is suspicious; OriginalFileName catches renamed copies |
wmic.exe with /FORMAT referencing a non-default stylesheet, a URL or a user-writable path | Sysmon 1, Security 4688 with command line | The WMIC variant; legitimate use of custom stylesheets is rare |
msxsl.exe or wmic.exe loading jscript.dll, vbscript.dll or scrobj.dll | Sysmon 7 | The script engine load is the point where embedded script runs (AN0581) |
| Network connections or DNS queries from msxsl.exe or wmic.exe | Sysmon 3 and 22 | Remote stylesheets, as used by Astaroth and Lazarus Group |
| Child processes or new files from msxsl.exe or wmic.exe | Sysmon 1 (parent), Sysmon 11 | Follow-on payloads, such as the downloaded DLL in Operation Dream Job |
| Files with XSL content but other extensions | File inspection, YARA, content scanning | ATT&CK notes arbitrary extensions are used to disguise the stylesheet |
Image load logging (Sysmon 7) is disabled by default and Microsoft warns that logging every load generates a lot of data, so scope it to the processes above. See the Sysmon Guide and, for portable rules, the Sigma Rules Guide.
Prevention and hardening
ATT&CK v20 lists one mitigation: M1038 Execution Prevention, "If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries." The other rows are NHI Mgmt Group recommendations.
| Control | Setting or approach | Notes |
|---|---|---|
| Block msxsl.exe | App Control for Business or AppLocker deny rule on the file's OriginalFileName or hash; default-deny application control blocks it anyway because it is not part of Windows. See the Application Allowlisting Guide | M1038 |
| Microsoft recommended block rules | The recommended block list denies wmic.exe for all versions and includes rules for msxml3.dll, msxml6.dll and jscript9.dll with OS-specific caveats (Microsoft advises only the RS1 rules on Windows Server 2016). Merge and audit first | M1038; test carefully, as msxml libraries are widely used |
| Remove WMIC | Use Windows 11 24H2 or later where Microsoft states WMIC is removed; on older builds, remove the WMIC feature on demand where policy allows and migrate scripts to PowerShell CIM cmdlets | M1042 |
| Restrict outbound access | Host firewall rules denying internet connections from wmic.exe and any msxsl.exe path | M1037; blocks remote stylesheets |
| Mail and web filtering | Block or detonate XSL attachments and files containing XSL script blocks, whatever their extension | M1021 |
| Application code | Leave .NET XsltSettings.EnableScript at its default of false; Microsoft advises enabling XSLT scripting only "in a fully trusted environment" and marks the property obsolete | Secure development; see the SOAP and XML Web Services Security Guide |
WMIC status
Microsoft deprecated the WMIC utility in Windows 10, version 21H1, while stating that WMI itself is not affected. Its deprecated features page, checked in November 2026, says WMIC was a preinstalled feature on demand in Windows 11 22H2 and 23H2, and carries an August 2026 update stating that WMIC "is removed and is no longer available as a Feature on Demand (FoD) on Windows 11, version 24H2 and above". Older Windows 10 devices and Windows Server releases in your estate may still have it, so the block rule and detections remain necessary until the inventory shows otherwise. Check Microsoft's page for the current position before planning, as removal timelines can change.
How to implement and test
- Inventory: search endpoints for any file whose OriginalFileName is msxsl.exe and query 30 days of process data for wmic.exe with
/FORMAT. Find and migrate scripts that still call WMIC, including those run by service accounts and scheduled tasks. - Audit mode: deploy the msxsl.exe deny rule and the recommended block rules in audit mode; review events with application owners, paying particular attention to msxml library rules.
- Detection: deploy AN0581-style rules for process creation plus script engine loads, and the network rule for both carriers.
- Emulate safely: in a lab, process a benign stylesheet whose script writes a marker file, through both carriers, and confirm the alerts and the block.
- Enforce in rings and roll back by redeploying the previous policy version, with scoped, time-limited exceptions.
Metrics
- Number of devices where WMIC is still present, trending to zero.
- Count of msxsl.exe executions and blocks per month (target: zero executions).
- Percentage of devices enforcing the recommended block rules.
- Percentage of devices collecting scoped Sysmon 7 for wmic.exe and msxsl.exe.
Where identity fits
WMIC has long been embedded in administrative and monitoring scripts that run under service accounts and scheduled tasks. When removing it, inventory which non-human identities run those scripts, migrate them, and use the migration to confirm each account still needs its rights. A WMIC call from a service account that has never used it before is also worth an alert. See the Service Account Security Guide.
Common failure patterns
- Allowlisting by path: a dropped msxsl.exe in a user-writable or allowed folder runs, as Cobalt Group showed against AppLocker.
- Matching on .xsl only: attackers use arbitrary extensions.
- No image load telemetry: without Sysmon 7 or EDR equivalents, the script engine load that AN0581 depends on is invisible.
- Assuming WMIC is gone everywhere: removal applies to newer Windows 11 builds; older clients and servers may keep it.
- Enabling XSLT script in applications that process stylesheets from users or partners.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1220 (TA0005 Stealth); related T1047, T1127, T1218.010, T1105, T1140 | The technique and its neighbours |
| ATT&CK detection | DET0205 with AN0581 | Official analytic |
| ATT&CK mitigations | M1038 Execution Prevention (listed); M1042, M1037, M1021 (recommended) | Blocking msxsl.exe and WMIC; network and content controls |
| NIST SP 800-53 Rev. 5 | CM-7 Least Functionality; CM-7(5) Authorized Software; SI-4 System Monitoring | Removing unneeded tools; allow-by-exception execution; monitoring |
| NIST CSF 2.0 | PR.PS-05; DE.CM-09 | Preventing unauthorised software; monitoring endpoints |
Practitioner checklist
- Block msxsl.exe by OriginalFileName or hash, and confirm none is present on endpoints.
- Merge the recommended block rules (including wmic.exe), audit first.
- Track WMIC presence and migrate dependent scripts, including service account tasks.
- Alert on wmic.exe with /FORMAT referencing URLs or user paths.
- Collect scoped Sysmon 7 for wmic.exe and msxsl.exe and alert on script engine loads.
- Deny internet access to wmic.exe and msxsl.exe.
- Scan mail and web content for XSL script blocks regardless of extension.
- Keep XsltSettings.EnableScript off in .NET applications.
Standards and references
- MITRE ATT&CK: XSL Script Processing (T1220)
- MITRE ATT&CK: Operation Dream Job (C0022)
- Microsoft: Applications that can bypass App Control and how to block them
- Microsoft: Deprecated features in the Windows client
- Microsoft: XsltSettings.EnableScript property
- Microsoft Sysinternals: Sysmon
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Living off the Land Guide · T1218 System Binary Proxy Execution Defensive Guide · T1047 Windows Management Instrumentation Defensive Guide · ATT&CK Stealth and Defense Impairment Tactics Guide