huntrule

Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)

Alerts on EventID 6 Exchange management events that include "Install-TransportAgent", indicating a failed Transport Agent installation attempt.

FreeReviewedSigma · High · v2
Product
windows
Service
msexchange-management
Author
Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-06-08
Updated
2026-07-31
AnalysisDetection
title: "Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)"
id: 25c51436-b9a0-43a9-952c-c3472d9d1848
status: test
description: This rule identifies a failed Exchange Transport Agent installation attempt by matching an event with EventID 6 and data containing the string 'Install-TransportAgent'. Attackers may use Exchange extensibility to persist or alter mail flow, and failed attempts can still indicate hostile tooling or misconfiguration. It relies on MSExchange management service telemetry that records the installation command text and failure event.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-07-12
tags:
  - attack.persistence
  - attack.t1505.002
logsource:
  service: msexchange-management
  product: windows
detection:
  selection:
    EventID: 6
    Data|contains: Install-TransportAgent
  condition: selection
falsepositives:
  - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: high
license: DRL-1.1
related:
  - id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa
    type: derived