detection.wiki

Detection rules › Sigma

Exchange transport agent injection via configuration file

Status
experimental
Severity
high
Log source
product windows, category file_event
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.002 Server Software Component: Transport Agent

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Exchange transport agent injection via configuration file
description: Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
requirements: |
 requires to update SYSMON configuration to include the transport agent path (eg: '<TargetFilename condition="begin with">C:\Exchange2016\TransportRoles\Shared</TargetFilename>')
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1505-Server%20Software%20Component
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
tags:
- attack.persistence
- attack.t1505.002 # Server Software Component: Transport Agent 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: file_event # Event ID 11
detection:
  selection:
    TargetFilename|endswith: '\TransportRoles\Shared\agents.config'
  filter:
    Image: '\ExchangeSetup\ExSetupUI.exe' # Exchange installer / updater
  condition: selection and not filter
falsepositives:
- rare administrator change
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  TargetFilename|endswith: '\TransportRoles\Shared\agents.config'

Stage 2: not filter

filter:
  Image: '\ExchangeSetup\ExSetupUI.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageeq\ExchangeSetup\ExSetupUI.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • \TransportRoles\Shared\agents.config