AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File Creation/Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the creation or modification of 'WsmPty.xsl' or 'WsmTxt.xsl' files outside of the standard Windows system directories. This activity is indicative of an application whitelisting bypass technique involving 'winrm.vbs' and 'cscript.exe' to execute attacker-controlled XSL files.