Windows te.exe Execution of Test Components (TAEF) via Process Creation

Alerts on process activity involving te.exe, which may indicate TAEF-based execution of malicious test components.

FreeUnreviewedSigmalowv1

windows-te-exe-execution-of-test-components-taef-via-process-creation-634b00d5

title: Windows te.exe Execution of Test Components (TAEF) via Process Creation
id: 8e1bf847-02de-457c-92a1-10e27dac55b5
status: test
description: This rule flags process creation events where te.exe is launched, including cases where it appears as the original image name or as the parent process of another spawned process. Attackers can abuse the Windows Test Authoring and Execution Framework (TAEF) to run automation payloads through test components, making process lineage around te.exe important for identifying misuse. Telemetry relies on Windows process creation fields including Image, ParentImage, and OriginalFileName.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/
  - https://twitter.com/pabraeken/status/993298228840992768
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml
author: Agro (@agro_sev) oscd.community, Huntrule Team
date: 2020-10-13
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \te.exe
    - ParentImage|endswith: \te.exe
    - OriginalFileName: \te.exe
  condition: selection
falsepositives:
  - It's not an uncommon to use te.exe directly to execute legal TAEF tests
level: low
license: DRL-1.1
related:
  - id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b
    type: derived

What it detects

This rule flags process creation events where te.exe is launched, including cases where it appears as the original image name or as the parent process of another spawned process. Attackers can abuse the Windows Test Authoring and Execution Framework (TAEF) to run automation payloads through test components, making process lineage around te.exe important for identifying misuse. Telemetry relies on Windows process creation fields including Image, ParentImage, and OriginalFileName.

Known false positives

It's not an uncommon to use te.exe directly to execute legal TAEF tests

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.