
title: MSExchange Transport Agent Installation
author: Tobias Michalski
date: 2021/06/08
description: Detects the Installation of a Exchange Transport Agent
detection:
  condition: Install-TransportAgent
falsepositives:
- legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator
  for this.
fields:
- AssemblyPath
id: 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6
level: medium
logsource:
  product: windows
  service: msexchange-management
modified: 2021/09/19
references:
- https://twitter.com/blueteamsec1/status/1401290874202382336?s=20
related:
- id: 83809e84-4475-4b69-bc3e-4aad8568612f
  type: derived
status: experimental
tags:
- attack.persistence
- attack.t1505.002
ruletype: SIGMA
