te.exe

Commands

1. ExecuteUser T1127

   Execute Visual Basic script stored in local Windows Script Component file.

   te.exe {PATH:.wsc}

   Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file.

   os: Windows

   Execute: WSH

2. ExecuteUser T1127

   Execute DLL file.

   te.exe {PATH:.dll}

   Execute commands from a DLL file with Test Authoring and Execution Framework (TAEF) tests. See resources section for required structures.

   os: Windows

   Execute: DLLInput: Custom Format

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml

Resources

• https://twitter.com/gn3mes1s/status/927680266390384640
• https://github.com/LOLBAS-Project/LOLBAS/pull/359
• https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/authoring-tests