Malicious Windows Script Components File Execution by TAEF Detection
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe
Severity
Attention
Rule Requirement
Criteria
Action1:
actionname = "Process started" AND PROCESSNAME endswith "\te.exe" OR PARENTPROCESSNAME endswith "\te.exe" OR ORIGINALFILENAME = "\te.exe"
select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME,Action1.DOMAIN,Action1.ORIGINALFILENAME,Action1.PARENTPROCESSID,Action1.PROCESSID,Action1.PRODUCT_NAME,Action1.SECURITYID
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Agro (@agro_sev) oscd.community
