detection.wiki

Detection rules › Sigma

Exchange transport agent injection via configuration file

Status
experimental
Severity
high
Log source
category file_event, product windows
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.

Known false positives

  • rare administrator change

MITRE ATT&CK coverage

TacticTechniques
Persistence

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 11: FileCreate

Rule body

title: Exchange transport agent injection via configuration file
description: Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
requirements: |
 requires to update SYSMON configuration to include the transport agent path (eg: '<TargetFilename condition="begin with">C:\Exchange2016\TransportRoles\Shared</TargetFilename>')
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1505-Server%20Software%20Component
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
tags:
- attack.persistence
- attack.t1505.002 # Server Software Component: Transport Agent 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: file_event # Event ID 11
detection:
  selection:
    TargetFilename|endswith: '\TransportRoles\Shared\agents.config'
  filter:
    Image: '\ExchangeSetup\ExSetupUI.exe' # Exchange installer / updater
  condition: selection and not filter
falsepositives:
- rare administrator change
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  TargetFilename|endswith: '\TransportRoles\Shared\agents.config'

Stage 2: not filter

filter:
  Image: '\ExchangeSetup\ExSetupUI.exe'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
Imageeq\ExchangeSetup\ExSetupUI.exeexcludes:Image field:"Image" value:"\ExchangeSetup\ExSetupUI.exe"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetFilenameends_with
  • \TransportRoles\Shared\agents.config
field:"TargetFilename" kind:ends_with value:"\TransportRoles\Shared\agents.config"