Failed MSExchange Transport Agent Installation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects failed attempts to install an Exchange Transport Agent. It specifically looks for Event ID 6 in the MSExchange Management logs and the string 'Install-TransportAgent' within the event data. This could indicate an adversary attempting to establish persistence on an Exchange server.