Cross-source coverage

T1505.002 / ATT&CK

Server Software Component: Transport Agent

4 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails. Transport agents can be written by application developers and then compiled to.NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.

Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events. Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.

Tactics
Persistence
Platforms
Linux · Windows
Telemetry
WinEventLog:SysmonWinEventLog:PowerShellWinEventLog:Applicationauditd:SYSCALLlinux:syslogauditd:EXECVElinux:Sysmon

How MITRE says to detect it DET0166

Detection Strategy for T1505.002 - Transport Agent Abuse (Windows/Linux)

Windows Analytic 0472

Adversary registers a malicious Microsoft Exchange transport agent DLL (.NET assembly), configures it via PowerShell or Exchange Management Shell, and persists code execution by manipulating email processing logic based on rules or headers.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Application Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution
  • WinEventLog:Sysmon EventCode=11

Linux Analytic 0473

Adversary installs or modifies email content filters or transport scripts (e.g., Postfix milter, Sendmail milter, Exim filters) using shell access or configuration manipulation.

  • auditd:SYSCALL write
  • linux:syslog milter configuration updated, transport rule initialized, unexpected script execution
  • auditd:EXECVE /usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail
  • auditd:SYSCALL write
  • linux:Sysmon EventCode=7

View on attack.mitre.org ↗

SigmaHQ/sigma

3 rules
Detection Severity Format
Failed MSExchange Transport Agent Installation High Sigma
MSExchange Transport Agent Installation Medium Sigma
MSExchange Transport Agent Installation - Builtin Medium Sigma

elastic/protections-artifacts

1 rule
Detection Severity Format
Suspicious Execution via Microsoft Exchange Transport Agent Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.