Windows MSExchange Management: Transport Agent Installation via Install-TransportAgent

title: "Windows MSExchange Management: Transport Agent Installation via Install-TransportAgent"
id: 5835e06b-d17c-4d2e-a19e-8d91acbc044a
related:
  - id: 83809e84-4475-4b69-bc3e-4aad8568612f
    type: derived
  - id: 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6
    type: derived
status: test
description: This rule identifies attempts to install an Exchange Transport Agent by matching the Install-TransportAgent command in MSExchange management telemetry. Transport agents are powerful extensibility points in Exchange and can be abused to persist on the mail flow path. It relies on Windows MSExchange Management logs that capture the agent installation command.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_transportagent.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-11-27
tags:
  - attack.persistence
  - attack.t1505.002
logsource:
  product: windows
  service: msexchange-management
detection:
  selection:
    - Install-TransportAgent
  condition: selection
falsepositives:
  - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: medium
license: DRL-1.1