Sunturai
Back to results
MediumSplunk security contentMichael Haag +1

WMIC XSL Execution via URL

The following analytic detects `wmic.exe` loading a remote XSL script via a URL. This detection leverages Endpoint Detection and Response (EDR) data, focusing on command-line executions that include HTTP/HTTPS URLs…

Description

The following analytic detects `wmic.exe` loading a remote XSL script via a URL. This detection leverages Endpoint Detection and Response (EDR) data, focusing on command-line executions that include HTTP/HTTPS URLs and the /FORMAT switch. This activity is significant as it indicates a potential application control bypass, allowing adversaries to execute JScript or VBScript within an XSL file. If confirmed malicious, this technique can enable attackers to execute arbitrary code, escalate privileges, or maintain persistence using a trusted Windows tool, posing a severe threat to the environment.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
cisco_network_visibility_module_flow_datacrowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice