WMIC remote XSL format
wmic ... /format:<url> — XSL script processing.
What it detects
wmic ... /format:<url> — XSL script processing. The /format switch takes a stylesheet to render WMI output with, and the stylesheet may contain script, which WMIC executes. Pointing it at a URL or a UNC path turns a built-in administrative tool into a remote-code loader that leaves no payload binary on disk.
MITRE ATT&CK mapping
- T1220XSL Script Processing· Defense Evasion
False positives and triage
Administrators do use /format: — but with the local built-in stylesheets (csv, htable, list), which this rule does not match because they are neither URLs nor UNC paths. A stylesheet loaded from a fileserver is the one case worth checking before escalating.
To confirm: retrieve the stylesheet and look for <msxsl:script> — a formatting stylesheet has none. Preserve the URL as evidence, and check what the host contacted immediately afterwards, since the script's usual job is to stage a second-stage payload.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/wmic_remote_xsl_format.yaml, licensed under the Apache License 2.0.
id: windows.execution.wmic_remote_xsl_format
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1220]
description: |
`wmic ... /format:<url>` — XSL script processing. The `/format` switch takes a
stylesheet to render WMI output with, and the stylesheet may contain script, which
WMIC executes. Pointing it at a URL or a UNC path turns a built-in administrative
tool into a remote-code loader that leaves no payload binary on disk.
match:
command_line_regex: '(?i)/format:\s*"?(https?://|\\\\)'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Administrators do use `/format:` — but with the local built-in stylesheets
(`csv`, `htable`, `list`), which this rule does not match because they are neither
URLs nor UNC paths. A stylesheet loaded from a fileserver is the one case worth
checking before escalating.
To confirm: retrieve the stylesheet and look for `<msxsl:script>` — a formatting
stylesheet has none. Preserve the URL as evidence, and check what the host
contacted immediately afterwards, since the script's usual job is to stage a
second-stage payload.
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.