WMI XSL Script Processing via wmic /format or msxsl.exe (T1220)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

This rule detects the use of 'wmic.exe' with the '/format' switch to execute XSL files, or the direct execution of 'msxsl.exe'. These methods are common techniques used by adversaries to bypass security controls by executing arbitrary scripts embedded within XSL files, often fetched from remote locations or local paths.