AWL Bypass with Winrm.vbs and Malicious XSL via cscript.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl files via winrm.vbs and a potentially renamed cscript.exe. This technique is used to bypass Application Whitelisting (AWL) by leveraging legitimate Windows scripts.