Failed MSExchange Transport Agent Installation

Title: Failed MSExchange Transport Agent Installation
Status: test
Description:Detects a failed installation of a Exchange Transport Agent
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8
Author: Tobias Michalski (Nextron Systems)
Date: 2021-06-08
modified:2022-07-12
Tags:

• -'attack.persistence'
• -'attack.t1505.002'

Logsource:

• service: msexchange-management
• product: windows

Detection:
  selection:
    EventID: '6'
    Data|contains: 'Install-TransportAgent'
  condition:selection
Falsepositives:
  -Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
Level: high