Transport agent installed or enabled on a mail server

Siemphony@siemphonymediumT1505.002unverified

Matches the configuration half of AN0472: a script block naming one of the management cmdlets that registers, activates or reprioritises a transport agent on an Exchange server. Registration is the step that turns an attacker DLL into persistence — the assembly does nothing until it is installed into the transport pipeline and enabled — and it is a cmdlet call, so ScriptBlockText under EventID 4104 is the field that carries it whether it was typed into the Exchange Management Shell, pasted into a remote session or wrapped in an encoded one-liner. Set-TransportAgent is included because moving an agent to the front of the pipeline is how it guarantees it sees every message; the read-only Get-TransportAgent is deliberately excluded, because listing the agents is how ordinary administration and every troubleshooting session also begins. The brief's other three log sources were not used, and the reasons are worth stating: EdgeTransport.exe legitimately loads a large set of assemblies from the GAC and the Exchange install tree, so a Sysmon EventID 7 selector needs a verified baseline of that set which this corpus does not have, and MITRE's own AssemblyPath knob says the install paths vary by deployment, which removes the one anchor an EventID 11 file-creation rule would need. The rule therefore sees the registration, not the DLL: an agent installed by editing the pipeline configuration directly, or one already registered before logging was turned on, produces nothing here. EventID 4104 requires *Script Block Logging* to be enabled by policy — it is off in a default install and in the MS and CIS baselines — and because these cmdlets run against the Exchange server, the log has to be collected from that server rather than from the administrator's workstation. With either missing the rule returns zero rows, which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0166, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where (EventID == 4104 and (ScriptBlockText contains "Install-TransportAgent" or ScriptBlockText contains "Enable-TransportAgent" or ScriptBlockText contains "Set-TransportAgent"))

Splunk · SPL

Run this as a search.

index=* (EventID="4104" AND (ScriptBlockText="*Install-TransportAgent*" OR ScriptBlockText="*Enable-TransportAgent*" OR ScriptBlockText="*Set-TransportAgent*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*install-transportagent*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*enable-transportagent*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*set-transportagent*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Install-TransportAgent|Enable-TransportAgent|Set-TransportAgent)</field>    <description>Transport agent installed or enabled on a mail server</description>    <mitre>      <id>T1505.002</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 5d51d73d-9703-449a-b572-68968d8752b3

ATT&CKT1505.002

T1505.002Transport Agent

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A PowerShell script block naming one of the three Exchange cmdlets that register, activate or reprioritise a transport agent. AN0472 describes an adversary dropping a .NET assembly and wiring it into the Exchange transport pipeline; the DLL is inert until it is installed and enabled, so this rule watches the configuration step rather than the file. Every message through the pipeline then invokes the agent — that is what makes registration persistence.

02 · Telemetry you need

product: windows / service: powershell, from AN0472's PowerShell 4103-4106 entry, matched on EventID: 4104. Script Block Logging is off in a default install and in the MS and CIS baselines; without it the rule returns zero rows, and zero rows reads as quiet when it means blind.
Collect 4104 from the Exchange server and from any administrative workstation that runs the Exchange Management Shell. Implicit remoting means the cmdlet is compiled and logged by the PowerShell engine on whichever host it was typed on, so excluding admin workstations can drop the feed that most reliably carries the literal string. All four backends render the rule.

03 · How the logic works

One selection, two conditions ANDed: EventID: 4104, and ScriptBlockText|contains any of Install-TransportAgent, Enable-TransportAgent, Set-TransportAgent. Install and Enable are the registration pair. Set is included because moving an agent to the front of the pipeline is how it guarantees it sees every message before anything else does. The read-only Get-TransportAgent is deliberately absent — listing agents is how ordinary administration and every troubleshooting session begins. Three things the rule cannot see, none of them tunable: - An agent registered by editing the pipeline configuration directly, which is a real installer pattern, produces no cmdlet call. - An agent registered before Script Block Logging was turned on is already invisible; the rule sees registration, never the resulting state. - contains on a literal cmdlet name is defeated by concatenation — & ('Install-Transport'+'Agent') logs a script block containing neither literal. The review also noted that Set-TransportAgent carries the least evidence of the three yet alerts identically, which matters when you get to tuning. MITRE's other three sources went unused: a Sysmon EventID 7 selector needs a verified baseline of what EdgeTransport.exe legitimately loads from the GAC, and MITRE's AssemblyPath knob says install paths vary by deployment, removing the anchor an EventID 11 file-creation rule would need.

04 · Common false positives

Supported third-party transport agents — mail hygiene, DLP, journaling, archiving, signature tooling — call Install then Set during installation and repeat both on every product upgrade. Microsoft's own install-AntiSpamAgents.ps1 calls Install-TransportAgent once per agent, so one legitimate run produces a burst. Cumulative updates leave agents unregistered, and the restore during the change window looks identical. And Set-TransportAgent -Priority reordering is routine and involves no new code at all.
On a real Exchange estate essentially every match is one of those four. The rule shipped at high and the review corrected it to medium: the event is rare, but rare is not the same as high-confidence, and high renders as Wazuh level 12.

05 · Detection maturity

tier_1: , the lowest tier, and it stays there until it has been run against real data. UNVERIFIED: derived from DET0166 and never executed against a log line.
tier_2: starts by confirming 4104 actually arrives from the Exchange servers and the admin workstations, then counting a quarter of matches against known installs.
tier_3: pairs this with assembly-level telemetry, which needs the baseline the pipeline could not supply.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split the selection into selection_register (Install-, Enable-) and selection_reorder (Set-) with 1 of selection*, so the reorder branch can be dropped without losing registration coverage. Then baseline your own agents: Get-TransportAgent on each server gives you the legitimate assembly names, and anything registered outside a change window with a name not on that list is the signal. MITRE's CmdletInvocationThreshold knob is for repeated management-cmdlet use and its TimeWindow for the frequency of agent updates in your environment; neither is expressible in Sigma, so both belong in downstream correlation against your change calendar. If the estate genuinely runs no third-party agents, raising the level locally is defensible.

Declared by the author

Supported third-party transport agent products — mail hygiene, DLP, journaling, archiving and email-signature tooling — whose documented installers call Install-TransportAgent and then Set-TransportAgent to place themselves in the pipeline, and repeat both on every product upgrade.
Microsoft's own install-AntiSpamAgents.ps1, which is the documented way to turn on the built-in anti-spam agents on a Mailbox server and calls Install-TransportAgent once per agent, producing a burst of matches from a single legitimate run.
Post-update maintenance on the mail server, where a cumulative update leaves agents unregistered or disabled and an administrator re-runs Install-TransportAgent and Enable-TransportAgent to restore them during the change window.
Administrators reordering an existing pipeline with Set-TransportAgent -Priority, which is routine whenever two agents must run in a particular order and involves no new code at all.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1505.002, evaluated against their — events.

Share this rule

/u/siemphony/5d51d73d-9703-449a-b572-68968d8752b3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Transport agent installed or enabled on a mail server

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it