Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
13
11
1
1
Contributors
7
5
4
2
2
Categories
10
5
5
5
3
Platforms
15
5
3
3
1
Products / Services
15
5
3
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the Installation of a Exchange Transport Agent
'Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.'
This rule detects failed attempts to install an Exchange Transport Agent. It specifically looks for Event ID 6 in the MSExchange Management logs and the string 'Install-TransportAgent' within the event data. This could indicate an adversary attempting to establish persistence on an Exchange server.
This rule detects the installation of an Exchange Transport Agent. Transport agents are .NET assemblies that can operate on email messages passing through the Exchange transport pipeline. Adversaries may abuse this functionality to establish persistence, intercept emails, or exfiltrate data.
Detects the installation of a Microsoft Exchange Transport Agent by monitoring for the 'Install-TransportAgent' command-line argument. This activity can be used by adversaries to establish persistence on Exchange servers.
Page 2 of 2