Malicious Windows Script Components File Execution by TAEF Detection
This rule detects the execution of 'te.exe', the Windows Test Authoring and Execution Framework (TAEF) executable. Adversaries can abuse 'te.exe' to proxy the execution of malicious scripts or binaries, such as Windows Script Components (WSC) files containing VBScript or DLLs, thereby bypassing security controls. The rule specifically looks for 'te.exe' being executed as the main image, a parent image, or identified by its original filename.
Sigma
