Malicious Windows Script Components File Execution by TAEF Detection

Status: test
Severity: low
Log source: category process_creation, product windows
Author: Agro (@agro_sev) oscd.community
Source: github.com/SigmaHQ/sigma

Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe

Known false positives

It's not an uncommon to use te.exe directly to execute legal TAEF tests

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Malicious Windows Script Components File Execution by TAEF Detection
id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b
status: test
description: |
  Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces
  Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/
    - https://twitter.com/pabraeken/status/993298228840992768
    - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/
author: 'Agro (@agro_sev) oscd.community'
date: 2020-10-13
modified: 2021-11-27
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\te.exe'
        - ParentImage|endswith: '\te.exe'
        - OriginalFileName: '\te.exe'
    condition: selection
falsepositives:
    - It's not an uncommon to use te.exe directly to execute legal TAEF tests
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\te.exe'
    - ParentImage|endswith: '\te.exe'
    - OriginalFileName: '\te.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\te.exe`	`field:"Image" kind:ends_with value:"\te.exe"`
`OriginalFileName`	eq	`\te.exe`	`field:"OriginalFileName" kind:eq value:"\te.exe"`
`ParentImage`	ends_with	`\te.exe`	`field:"ParentImage" kind:ends_with value:"\te.exe"`