Network Connection via MsXsledit

Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-windows.*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100


  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Defense Evasion

Version: 6 (version history)

Added (Elastic Stack release): 7.7.0

Last modified (Elastic Stack release): 7.12.0

Rule authors: Elastic

Rule license: Elastic License v2

Rule queryedit

sequence by process.entity_id [process where :
"msxsl.exe" and event.type == "start"] [network where :
"msxsl.exe" and not cidrmatch(destination.ip, "",
"", "")]

Threat mappingedit


Rule version historyedit

Version 6 (7.12.0 release)
  • Formatting only
Version 5 (7.11.0 release)
  • Formatting only
Version 4 (7.10.0 release)
  • Updated query, changed from:

    event.category:network and event.type:connection and and not destination.ip:( or or
Version 3 (7.9.1 release)
  • Formatting only
Version 2 (7.9.0 release)
  • Updated query, changed from: and event.action:"Network connection detected
    (rule: NetworkConnect)" and not destination.ip:( or or