
title: MSExchange Transport Agent Installation
author: Tobias Michalski
date: 2021/06/08
description: Detects the Installation of a Exchange Transport Agent
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine: '*Install-TransportAgent*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator
  for this.
fields:
- AssemblyPath
id: 83809e84-4475-4b69-bc3e-4aad8568612f
level: medium
logsource:
  category: process_creation
  product: windows
modified: 2021/09/19
references:
- https://twitter.com/blueteamsec1/status/1401290874202382336?s=20
status: experimental
tags:
- attack.persistence
- attack.t1505.002
ruletype: SIGMA
