ATT&CK technique
View on MITRE ATT&CK →
T1220
XSL Script Processing
Stealth
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | XSL Script Execution With WMIC | production | 2026-10-02 |
| splunk | WMIC XSL Execution via URL | production | 2026-10-02 |
| splunk | Cisco NVM - Suspicious Network Connection Initiated via MsXsl | production | 2026-09-22 |
| elastic | Suspicious WMIC XSL Script Execution | production | 2026-09-18 |
| elastic | Network Connection via MsXsl | production | 2026-09-18 |
| elastic | Delayed Execution via Ping | production | 2026-09-18 |
| elastic | Remote XSL Script Execution via COM | production | 2026-09-18 |
| sigma | XSL Script Execution Via WMIC.EXE | test | 2026-01-24 |
| sigma | Potential Remote SquiblyTwo Technique Execution | test | 2026-01-24 |
| sigma | Remote XSL Execution Via Msxsl.EXE | test | 2023-11-09 |
| sigma | Msxsl.EXE Execution | test | 2023-11-09 |
| sigma | WMIC Loading Scripting Libraries | test | 2022-10-13 |