WMI Backdoor via Exchange Transport Agent Process Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the creation of a process where the parent process is 'EdgeTransport.exe' and the child process is not 'conhost.exe' or 'OleConverter.exe'. This behavior is indicative of a WMI backdoor being used in Exchange Transport Agents, leveraging WMI event filters for persistence or execution.