huntrule

Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent

Flags Windows command-line executions containing Install-TransportAgent, indicating Exchange Transport Agent installation activity.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-06-08
Updated
2026-07-30
AnalysisDetection
title: "Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent"
id: a233483c-8826-43cf-89b1-0a492643ae0f
related:
  - id: 83809e84-4475-4b69-bc3e-4aad8568612f
    type: similar
  - id: 83809e84-4475-4b69-bc3e-4aad8568612f
    type: derived
status: test
description: This rule identifies executions where a process command line contains the PowerShell command Install-TransportAgent, indicating an attempt to install an Exchange Transport Agent. Attackers may use transport agents to persist or extend email transport behavior within an Exchange environment. The detection relies on Windows process creation telemetry and specifically matches the command-line text used to perform the installation.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-08
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.t1505.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: Install-TransportAgent
  condition: selection
falsepositives:
  - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: medium
license: DRL-1.1