IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Remote XSL Script Execution via COM
editRemote XSL Script Execution via COM
editIdentifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes. This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system.
Rule type: eql
Rule indices:
- logs-endpoint.events.*
Severity: low
Risk score: 21
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References: None
Tags:
- Domain: Endpoint
- OS: Windows
- Use Case: Threat Detection
- Tactic: Initial Access
- Tactic: Defense Evasion
- Rule Type: BBR
- Data Source: Elastic Defend
Version: 1
Rule authors:
- Elastic
Rule license: Elastic License v2
Rule query
editsequence with maxspan=1m
[library where host.os.type == "windows" and dll.name : "msxml3.dll" and
process.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe")] by process.entity_id
[process where host.os.type == "windows" and event.action == "start" and
process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe") and
not process.executable :
("?:\\Windows\\System32\\WerFault.exe",
"?:\\Windows\\SysWoW64\\WerFault.exe",
"?:\\windows\\splwow64.exe",
"?:\\Windows\\System32\\conhost.exe",
"?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*exe")] by process.parent.entity_id
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
-
Technique:
- Name: Phishing
- ID: T1566
- Reference URL: https://attack.mitre.org/techniques/T1566/
-
Sub-technique:
- Name: Spearphishing Link
- ID: T1566.002
- Reference URL: https://attack.mitre.org/techniques/T1566/002/
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: XSL Script Processing
- ID: T1220
- Reference URL: https://attack.mitre.org/techniques/T1220/