MSExchange Transport Agent Installation

Title: MSExchange Transport Agent Installation
Status: test
Description:Detects the Installation of a Exchange Transport Agent
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
Author: Tobias Michalski (Nextron Systems)
Date: 2021-06-08
modified:2022-10-09
Tags:

• -'attack.persistence'
• -'attack.t1505.002'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    CommandLine|contains: 'Install-TransportAgent'
  condition:selection
Falsepositives:
  -Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
Level: medium