Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent

Flags Windows command-line executions containing Install-TransportAgent, indicating Exchange Transport Agent installation activity.

FreeUnreviewedSigmamediumv1

windows-process-creation-exchange-transport-agent-installation-via-install-trans-83809e84

title: "Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent"
id: a233483c-8826-43cf-89b1-0a492643ae0f
related:
  - id: 83809e84-4475-4b69-bc3e-4aad8568612f
    type: similar
  - id: 83809e84-4475-4b69-bc3e-4aad8568612f
    type: derived
status: test
description: This rule identifies executions where a process command line contains the PowerShell command Install-TransportAgent, indicating an attempt to install an Exchange Transport Agent. Attackers may use transport agents to persist or extend email transport behavior within an Exchange environment. The detection relies on Windows process creation telemetry and specifically matches the command-line text used to perform the installation.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.t1505.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: Install-TransportAgent
  condition: selection
falsepositives:
  - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: medium
license: DRL-1.1

What it detects

This rule identifies executions where a process command line contains the PowerShell command Install-TransportAgent, indicating an attempt to install an Exchange Transport Agent. Attackers may use transport agents to persist or extend email transport behavior within an Exchange environment. The detection relies on Windows process creation telemetry and specifically matches the command-line text used to perform the installation.

Known false positives

Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.