detection.wiki

Detection rules › Sigma

Exchange transport agent installation artifacts (native)

Status
experimental
Severity
high
Log source
product windows, service msexchange-management
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.002 Server Software Component: Transport Agent

Rule body yaml

title: Exchange transport agent installation artifacts (native)
description: Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1505-Server%20Software%20Component
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
tags:
- attack.persistence
- attack.t1505.002 # Server Software Component: Transport Agent 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: msexchange-management
detection:
  selection:
    EventID:
      - 1 # success
      - 6 # failure
    EventData|contains:
      - Enable-TransportAgent
      - Install-TransportAgent
  condition: selection
falsepositives:
- rare administrator change
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID:
    - 1
    - 6
  EventData|contains:
    - Enable-TransportAgent
    - Install-TransportAgent

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventDatamatch
  • Enable-TransportAgent corpus 2 (sigma 2)
  • Install-TransportAgent corpus 2 (sigma 2)