defensive-xxe

What problem does it solve?

XML processing often exposes applications to XXE vulnerabilities via DOCTYPE and ENTITY definitions. This skill provides a structured approach to detect and triage XXE indicators in XML inputs, enabling faster remediation.

Core Features & Use Cases

• Detection Coverage: identifies DOCTYPE/ENTITY usage, OOB callback patterns, and file:// based read attempts.
• Threat Coverage: includes Sigma rules for XML injection, YARA rules for XXE payloads, and KQL for Azure WAF and MDE network telemetry.
• Use Case: SOC teams can harden XML parsers and set up monitoring to alert on XXE indicators during XML processing.

Quick Start

Load the XXE detection methodology into the XML processing pipeline to identify DOCTYPE/ENTITY patterns and OOB callbacks.