{"id":"T1505.002","name":"Transport Agent","url":"https://attack.mitre.org/techniques/T1505/002","tactics":["persistence"],"platforms":["Linux","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0166","stix_id":"x-mitre-detection-strategy--90ee8005-5476-422f-abe0-6c231f004cd6","name":"Detection Strategy for T1505.002 - Transport Agent Abuse (Windows/Linux)","url":"https://attack.mitre.org/detectionstrategies/DET0166","analytics":[{"id":"AN0472","stix_id":"x-mitre-analytic--c94b2c2b-8885-4f5e-abec-e80ab0a24f21","name":"Analytic 0472","description":"Adversary registers a malicious Microsoft Exchange transport agent DLL (.NET assembly), configures it via PowerShell or Exchange Management Shell, and persists code execution by manipulating email processing logic based on rules or headers.","url":"https://attack.mitre.org/detectionstrategies/DET0166#AN0472","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Application","channel":"Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-application"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"May need tuning based on frequency of Exchange agent updates in environment."},{"field":"AssemblyPath","description":"Specific DLL paths used by Exchange for registered agents may vary between deployments."},{"field":"CmdletInvocationThreshold","description":"Tunable threshold for repeated use of transport agent management cmdlets."}],"live":true,"detection_strategies":["DET0166"],"techniques":["T1505.002"]},{"id":"AN0473","stix_id":"x-mitre-analytic--2c64ece9-c40f-4d1a-babf-106f587454d0","name":"Analytic 0473","description":"Adversary installs or modifies email content filters or transport scripts (e.g., Postfix milter, Sendmail milter, Exim filters) using shell access or configuration manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0166#AN0473","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"milter configuration updated, transport rule initialized, unexpected script execution","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"linux-syslog"},{"name":"auditd:EXECVE","channel":"/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"},{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"linux:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"linux-sysmon"}],"mutable_elements":[{"field":"MailTransportScriptPath","description":"Path to custom scripts or filters depends on mail daemon (e.g., /etc/postfix/milter/, /etc/exim4/)."},{"field":"UserContext","description":"Mail agents may run under different service users (postfix, exim, etc.), which should be scoped."},{"field":"ExecFrequencyThreshold","description":"Frequency of filter script re-execution per daemon restart or reload may vary."}],"live":true,"detection_strategies":["DET0166"],"techniques":["T1505.002"]}],"live":true,"version":"1.0","techniques":["T1505.002"]}],"sigma_rules":[{"id":"4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6","title":"MSExchange Transport Agent Installation - Builtin","author":"Tobias Michalski (Nextron Systems)","status":"test","level":"medium","date":"2021-06-08","modified":"2022-11-27","description":"Detects the Installation of a Exchange Transport Agent","references":["https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7"],"logsource":{"product":"windows","service":"msexchange-management"},"tags":["attack.persistence","attack.t1505.002"],"path":"rules/windows/builtin/msexchange/win_exchange_transportagent.yml","techniques":["T1505.002"],"cves":[]},{"id":"83809e84-4475-4b69-bc3e-4aad8568612f","title":"MSExchange Transport Agent Installation","author":"Tobias Michalski (Nextron Systems)","status":"test","level":"medium","date":"2021-06-08","modified":"2022-10-09","description":"Detects the Installation of a Exchange Transport Agent","references":["https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.t1505.002"],"path":"rules/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml","techniques":["T1505.002"],"cves":[]},{"id":"c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa","title":"Failed MSExchange Transport Agent Installation","author":"Tobias Michalski (Nextron Systems)","status":"test","level":"high","date":"2021-06-08","modified":"2022-07-12","description":"Detects a failed installation of a Exchange Transport Agent","references":["https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8"],"logsource":{"product":"windows","service":"msexchange-management"},"tags":["attack.persistence","attack.t1505.002"],"path":"rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml","techniques":["T1505.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}