Windows MSExchange Transport Agent Installation via Install-TransportAgent

Flags Exchange Transport Agent installation attempts using the Install-TransportAgent command in MSExchange management telemetry.

FreeReviewedSigma · Medium · v2
Product
windows
Service
msexchange-management
Author
Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-06-08
Updated
2026-07-31

ATT&CK techniques

Persistence
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Priv Esc

  6. Defense Evasion

  7. Cred Access

  8. Discovery

  9. Lateral Movement

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule flags execution of the Exchange Management shell command Install-TransportAgent. Installing a Transport Agent is a common persistence technique because it can extend Exchange transport processing and execute custom code within the mail flow path. The detection relies on Windows telemetry from the msexchange-management service capturing the Install-TransportAgent command invocation.

Related detections4 linkedT1505.002 — drag to rearrange
Malicious Exchange Transport Agent Installation Artifacts - Native (via msexchange-management)
Malicious Exchange Transport Agent Injection via Configuration File (via file_event)
Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent
Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)
Windows MSExchange Transport Agent Installation via Install-TransportAgent
Pivot detection · T1505.002 · 4 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.