MSExchange Transport Agent Installation - Builtin

Title: MSExchange Transport Agent Installation - Builtin
Status: test
Description:Detects the Installation of a Exchange Transport Agent
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
Author: Tobias Michalski (Nextron Systems)
Date: 2021-06-08
modified:2022-11-27
Tags:

• -'attack.persistence'
• -'attack.t1505.002'

Logsource:

• product: windows
• service: msexchange-management

Detection:
  selection:
    - 'Install-TransportAgent'
  condition:selection
Falsepositives:
  -Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
Level: medium