Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)
Alerts on EventID 6 Exchange management events that include "Install-TransportAgent", indicating a failed Transport Agent installation attempt.
- Product
- windows
- Service
- msexchange-management
- Author
- Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-06-08
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies a failed Exchange Transport Agent installation attempt by matching an event with EventID 6 and data containing the string 'Install-TransportAgent'. Attackers may use Exchange extensibility to persist or alter mail flow, and failed attempts can still indicate hostile tooling or misconfiguration. It relies on MSExchange management service telemetry that records the installation command text and failure event.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)"
id: 25c51436-b9a0-43a9-952c-c3472d9d1848
status: test
description: This rule identifies a failed Exchange Transport Agent installation attempt by matching an event with EventID 6 and data containing the string 'Install-TransportAgent'. Attackers may use Exchange extensibility to persist or alter mail flow, and failed attempts can still indicate hostile tooling or misconfiguration. It relies on MSExchange management service telemetry that records the installation command text and failure event.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-07-12
tags:
- attack.persistence
- attack.t1505.002
logsource:
service: msexchange-management
product: windows
detection:
selection:
EventID: 6
Data|contains: Install-TransportAgent
condition: selection
falsepositives:
- Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: high
license: DRL-1.1
related:
- id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa
type: derived