Windows MSExchange Transport Agent Installation via Install-TransportAgent
Flags Exchange Transport Agent installation attempts using the Install-TransportAgent command in MSExchange management telemetry.
- Product
- windows
- Service
- msexchange-management
- Author
- Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-06-08
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the Exchange Management shell command Install-TransportAgent. Installing a Transport Agent is a common persistence technique because it can extend Exchange transport processing and execute custom code within the mail flow path. The detection relies on Windows telemetry from the msexchange-management service capturing the Install-TransportAgent command invocation.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows MSExchange Transport Agent Installation via Install-TransportAgent
id: 5835e06b-d17c-4d2e-a19e-8d91acbc044a
related:
- id: 83809e84-4475-4b69-bc3e-4aad8568612f
type: derived
- id: 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6
type: derived
status: test
description: This rule flags execution of the Exchange Management shell command Install-TransportAgent. Installing a Transport Agent is a common persistence technique because it can extend Exchange transport processing and execute custom code within the mail flow path. The detection relies on Windows telemetry from the msexchange-management service capturing the Install-TransportAgent command invocation.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_transportagent.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-11-27
tags:
- attack.persistence
- attack.t1505.002
logsource:
product: windows
service: msexchange-management
detection:
selection:
- Install-TransportAgent
condition: selection
falsepositives:
- Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: medium
license: DRL-1.1