Windows MSExchange Management: Failed Transport Agent Installation (Install-TransportAgent)

Alerts on EventID 6 Exchange management events that include "Install-TransportAgent", indicating a failed Transport Agent installation attempt.

FreeUnreviewedSigmahighv1

windows-msexchange-management-failed-transport-agent-installation-install-transp-c7d16cae

title: "Windows MSExchange Management: Failed Transport Agent Installation (Install-TransportAgent)"
id: 25c51436-b9a0-43a9-952c-c3472d9d1848
status: test
description: This rule flags failed attempts to install an Exchange Transport Agent by matching management service events with EventID 6 containing the command string "Install-TransportAgent". Such activity matters because Transport Agents can be used to influence or extend message processing, making installation attempts a persistence-relevant change. It relies on msexchange-management service telemetry on Windows, specifically the event ID and the presence of the installation command in the event data.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-07-12
tags:
  - attack.persistence
  - attack.t1505.002
logsource:
  service: msexchange-management
  product: windows
detection:
  selection:
    EventID: 6
    Data|contains: Install-TransportAgent
  condition: selection
falsepositives:
  - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: high
license: DRL-1.1
related:
  - id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa
    type: derived

What it detects

This rule flags failed attempts to install an Exchange Transport Agent by matching management service events with EventID 6 containing the command string "Install-TransportAgent". Such activity matters because Transport Agents can be used to influence or extend message processing, making installation attempts a persistence-relevant change. It relies on msexchange-management service telemetry on Windows, specifically the event ID and the presence of the installation command in the event data.

Known false positives

Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.