huntrule

Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent

Flags Windows command-line executions containing Install-TransportAgent, indicating Exchange Transport Agent installation activity.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-06-08
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies executions where a process command line contains the PowerShell command Install-TransportAgent, indicating an attempt to install an Exchange Transport Agent. Attackers may use transport agents to persist or extend email transport behavior within an Exchange environment. The detection relies on Windows process creation telemetry and specifically matches the command-line text used to perform the installation.

Reporting behind it

Related detections4 linkedT1505.002 — drag to rearrange
Malicious Exchange Transport Agent Installation Artifacts - Native (via msexchange-management)
Malicious Exchange Transport Agent Injection via Configuration File (via file_event)
Windows MSExchange Transport Agent Installation via Install-TransportAgent
Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)
Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent
Pivot detection · T1505.002 · 4 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.