LOLBAS/yml/OtherMSBinaries/Te.yml

---
Name: te.exe
Description: Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).
Author: Oddvar Moe
Created: 2018-05-25
Commands:
  - Command: te.exe bypass.wsc
    Description: Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file.
    Usecase: Execute Visual Basic script stored in local Windows Script Component file.
    Category: Execute
    Privileges: User
    MitreID: T1127
    OperatingSystem: Windows
  - Command: te.exe test.dll
    Description: Execute commands from a DLL file with Test Authoring and Execution Framework (TAEF) tests. See resources section for required structures.
    Usecase: Execute DLL file.
    Category: Execute
    Privileges: User
    MitreID: T1127
    OperatingSystem: Windows
    Tags:
      - Execute: DLL
      - Input: Custom Format
Full_Path:
  - Path: no default
Detection:
  - Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml
Resources:
  - Link: https://twitter.com/gn3mes1s/status/927680266390384640
  - Link: https://github.com/LOLBAS-Project/LOLBAS/pull/359
  - Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/authoring-tests
Acknowledgement:
  - Person: Giuseppe N3mes1s
    Handle: '@gN3mes1s'
  - Person: Avihay Eldad
    Handle: '@AvihayEldad'
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`---`
			`Name: te.exe`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Description: Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).`
Update Te.yml (#359) Co-authored-by: Wietze <wietze@users.noreply.github.com> 2024-03-31 14:43:00 +02:00			`Author: Oddvar Moe`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Created: 2018-05-25`
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`Commands:`
			`- Command: te.exe bypass.wsc`
			`Description: Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file.`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Usecase: Execute Visual Basic script stored in local Windows Script Component file.`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`Category: Execute`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Privileges: User`
More changes (mainly changing generic T1218 to dev-specific T1127) 2021-11-05 21:06:57 +01:00			`MitreID: T1127`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`OperatingSystem: Windows`
Update Te.yml (#359) Co-authored-by: Wietze <wietze@users.noreply.github.com> 2024-03-31 14:43:00 +02:00			`- Command: te.exe test.dll`
			`Description: Execute commands from a DLL file with Test Authoring and Execution Framework (TAEF) tests. See resources section for required structures.`
			`Usecase: Execute DLL file.`
			`Category: Execute`
			`Privileges: User`
			`MitreID: T1127`
			`OperatingSystem: Windows`
Adding tags (closes #9, #318) (#362) * Adding various tags as a first iteration * Adding quotes * Adding 'Custom Format' properly * Updating to key:value pairs * Update template 2024-04-03 17:53:36 +02:00			`Tags:`
			`- Execute: DLL`
			`- Input: Custom Format`
Major changes to Web portal - Small fixes to source files to adjust 2018-12-10 14:28:12 +01:00			`Full_Path:`
Adding no defualt paths to pass schema validations 2022-09-11 06:16:59 +02:00			`- Path: no default`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`Detection:`
$frack113$ Update old sigma link (#303) * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> --------- Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> 2023-10-18 17:30:34 +02:00			`- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml`
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`Resources:`
Update Te.yml (#359) Co-authored-by: Wietze <wietze@users.noreply.github.com> 2024-03-31 14:43:00 +02:00			`- Link: https://twitter.com/gn3mes1s/status/927680266390384640`
			`- Link: https://github.com/LOLBAS-Project/LOLBAS/pull/359`
			`- Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/authoring-tests`
Fixed some typos 2019-09-17 20:45:49 +02:00			`Acknowledgement:`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`- Person: Giuseppe N3mes1s`
			`Handle: '@gN3mes1s'`
Update Te.yml (#359) Co-authored-by: Wietze <wietze@users.noreply.github.com> 2024-03-31 14:43:00 +02:00			`- Person: Avihay Eldad`
			`Handle: '@AvihayEldad'`