How can msxsl.exe be used to bypass AppLocker restrictions on script execution?
Msxsl.exe is a Microsoft-signed command-line tool that processes XSL transformations. By crafting an XML file that contains embedded JScript or VBScript code, an attacker can invoke `msxsl.exe` with that XML as input. Because the binary is trusted by AppLocker, the script runs without triggering script execution rules. This technique is detailed in the article Use msxsl to bypass AppLocker.
msxsl.exeAppLocker bypassJScriptVBScriptsigned binaryXML script execution