huntrule

Windows MSExchange Transport Agent Installation via Install-TransportAgent

Flags Exchange Transport Agent installation attempts using the Install-TransportAgent command in MSExchange management telemetry.

FreeReviewedSigma · Medium · v2
Product
windows
Service
msexchange-management
Author
Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-06-08
Updated
2026-07-31
AnalysisDetection
title: Windows MSExchange Transport Agent Installation via Install-TransportAgent
id: 5835e06b-d17c-4d2e-a19e-8d91acbc044a
related:
  - id: 83809e84-4475-4b69-bc3e-4aad8568612f
    type: derived
  - id: 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6
    type: derived
status: test
description: This rule flags execution of the Exchange Management shell command Install-TransportAgent. Installing a Transport Agent is a common persistence technique because it can extend Exchange transport processing and execute custom code within the mail flow path. The detection relies on Windows telemetry from the msexchange-management service capturing the Install-TransportAgent command invocation.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_transportagent.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-11-27
tags:
  - attack.persistence
  - attack.t1505.002
logsource:
  product: windows
  service: msexchange-management
detection:
  selection:
    - Install-TransportAgent
  condition: selection
falsepositives:
  - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: medium
license: DRL-1.1