XSL Script Execution Via WMIC.EXE
This rule detects the execution of `wmic.exe` with the `-format` flag, specifically looking for instances where the format specified is not one of the commonly known, legitimate WMIC output formats (e.g., List, htable, mof, xml, csv). Adversaries can abuse this functionality to load and execute malicious XSL (Extensible Stylesheet Language) files, potentially bypassing application whitelisting defenses. This technique is often referred to as "Squiblytwo" and leverages WMIC to invoke JScript or VBScript embedded within an XSL file.
Sigma
