Malicious Exchange Transport Agent Installed

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects network traffic indicating the installation of a Transport Agent on an Exchange server. It specifically looks for the strings "TransportAgent" and "Install-TransportAgent" in TCP traffic directed to port 25 of the home network, suggesting a potential malicious or unauthorized installation of an Exchange Transport Agent.