{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/msxsl/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Elastic Defend","SentinelOne Cloud Funnel"],"_cs_severities":["low"],"_cs_tags":["defense-evasion","command-and-control","windows","msxsl"],"_cs_type":"advisory","_cs_vendors":["Elastic","SentinelOne"],"content_html":"\u003cp\u003eMsXsl.exe is a Windows utility designed to transform XML data using XSLT stylesheets. Adversaries are known to abuse this utility to execute malicious scripts, bypassing application control and other security measures. This behavior is often used as a defense evasion technique to download or execute malicious payloads. This activity has been observed since at least March 2020. The abuse of msxsl.exe allows attackers to establish command and control or exfiltrate sensitive data without being easily detected, as the tool is a signed Microsoft binary. This matters for defenders because it highlights the need to monitor legitimate system utilities for anomalous behavior, specifically network connections to external IP addresses.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a Windows system through unspecified means.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages msxsl.exe to execute a malicious script.\u003c/li\u003e\n\u003cli\u003eMsxsl.exe initiates a network connection to an external IP address.\u003c/li\u003e\n\u003cli\u003eThe script downloads a malicious payload from the external server.\u003c/li\u003e\n\u003cli\u003eThe downloaded payload is executed on the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a command and control channel through the network connection.\u003c/li\u003e\n\u003cli\u003eThe attacker performs data exfiltration via the established C2 channel.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eCompromised systems can be used for further malicious activities, including data theft, lateral movement, and deployment of additional malware. Successful exploitation can lead to sensitive data exfiltration, disruption of services, or complete system compromise. The low risk score does not represent impact, but instead reflects that the behavior is not always malicious, and may be a feature of normal software operation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon network connection logging to monitor msxsl.exe network activity.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Network Connection via MsXsl\u0026rdquo; to your SIEM and tune for your environment to detect suspicious network connections originating from msxsl.exe.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule, focusing on the destination IP address and the parent process of msxsl.exe.\u003c/li\u003e\n\u003cli\u003eWhitelist legitimate uses of msxsl.exe in your environment based on known good processes or applications to reduce false positives.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-30T10:00:00Z","date_published":"2024-01-30T10:00:00Z","id":"/briefs/2024-01-msxsl-network-connection/","summary":"Msxsl.exe, a legitimate Windows utility, is being abused by adversaries to make network connections to non-local IPs for command and control or data exfiltration, potentially bypassing security measures.","title":"MsXsl.exe Network Connection for Defense Evasion","url":"https://feed.craftedsignal.io/briefs/2024-01-msxsl-network-connection/"}],"language":"en","title":"CraftedSignal Threat Feed — Msxsl","version":"https://jsonfeed.org/version/1.1"}