1200KM / simulation
T1220 XSL Script Processing — Attack Simulation
Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing…
Technique description
Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- WMIC bypass using local XSL file
Procedure 1b237334-3e21-4a0c-8178-b8c996124988; elevation not declared required; cleanup not declared. Not executed or individually validated.
- WMIC bypass using remote XSL file
Procedure 7f5be499-33be-4129-a560-66021f379b9b; elevation not declared required; cleanup not declared. Not executed or individually validated.
- MSXSL Bypass using remote files
Procedure a7c3ab07-52fb-49c8-ab6d-e9c6d4a0a985; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- MSXSL Bypass using local files
Procedure ca23bfb2-023f-49c5-8802-e66997de462d; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.