te.exe

Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file.

Use Execute Visual Basic script stored in local Windows Script Component file.

te.exe {PATH:.wsc}

Context

user

Native

Execute

MITRE

T1127

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml

Refs

twitter.com/gn3mes1s/status/927680266390384640

github.com/LOLBAS-Project/LOLBAS/pull/359

learn.microsoft.com/en-us/windows-hardware/drivers/taef/authoring-tests

lolbas-project.github.io/lolbas/OtherMSBinaries/te/

Execute commands from a DLL file with Test Authoring and Execution Framework (TAEF) tests. See resources section for required structures.

Use Execute DLL file.

te.exe {PATH:.dll}

Context

user

Native

Execute

MITRE

T1127

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml

Refs

twitter.com/gn3mes1s/status/927680266390384640

github.com/LOLBAS-Project/LOLBAS/pull/359

learn.microsoft.com/en-us/windows-hardware/drivers/taef/authoring-tests

lolbas-project.github.io/lolbas/OtherMSBinaries/te/