Identifier / Programs / Windows
te.exe
Test Authoring and Execution Framework [v10.43k] file version info (xCyclopedia)
LOLBAS Execute 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands 1 known copy with hashes
How te.exe is abused
Execute T1127 Trusted Developer Utilities Proxy Execution
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for te.exe.
2 documented commands
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file.
te.exe {PATH:.wsc}Trips 1 Sigma rule: lowMalicious Windows Script Components File Execution by TAEF Detection by Agro (@agro_sev) oscd.community
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Execute commands from a DLL file with Test Authoring and Execution Framework (TAEF) tests. See resources section for required structures.
te.exe {PATH:.dll}Trips 1 Sigma rule: lowMalicious Windows Script Components File Execution by TAEF Detection by Agro (@agro_sev) oscd.community
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for te.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for te.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real te.exe?
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\1 known copy
10.43.1909.04003 · C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\TE.exe · signed by Microsoft Corporation
538981e1d87081f1e6f2e1d6296af604072dbfc65638540326dc537ba5f6263cFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.