T1505.002 — Transport Agent

Tactic: Persistence · Platforms: Linux, Windows

Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or…

Sub-technique of Server Software Component (T1505).

Sigma detection rules (2)

T1505.002 Server Software Component: Transport Agent

title: "T1505.002 Server Software Component: Transport Agent"
id: d267953f-41f5-4db3-b0cd-d80da6ab1f60
description: 'Detects PowerShell invocation of the Install-TransportAgent, Enable-TransportAgent, or New-TransportAgent Exchange cmdlets used to register a custom transport agent DLL in the Exchange transport pipeline, replacing the prior bare Application-log EventID 1 match which had no tie to Exchange transport agent registration. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AssemblyPath, CmdletInvocationThreshold.'
references:
  - https://attack.mitre.org/techniques/T1505/002
author: Shahrukh Khan
date: 2026-03-01
license: MIT
tags:
  - attack.persistence
  - attack.t1505.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '1'
    CommandLine|contains:
      - 'Install-TransportAgent'
      - 'Enable-TransportAgent'
      - 'New-TransportAgent'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Legitimate Exchange administration installing approved transport agents (e.g., DLP or disclaimer add-ins).

level: medium

T1505.002 Server Software Component: Transport Agent

title: "T1505.002 Server Software Component: Transport Agent"
id: fe071ec2-4543-405b-b9af-82f3127a6c71
description: 'Detection Strategy for T1505.002 - Transport Agent Abuse. T1505.002 as scoped by ATT&CK is specifically about malicious Microsoft Exchange .NET transport agents and has no exact Linux equivalent; Postfix milter and content_filter mail-pipeline hooks are the closest architectural analog, a pluggable component invoked on every message passing through the transport pipeline, so this rule is a coarse proxy rather than a literal match. Fixed the previous logsource mismatch, which declared image_load while matching EXECVE process-creation records, to process_creation, and retargeted from generic postfix or sendmail execution to actual milter or content_filter registration: postconf setting smtpd_milters, non_smtpd_milters, or content_filter, or a write to /etc/postfix/main.cf where those directives live. Tune using: MailTransportScriptPath, UserContext, ExecFrequencyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1505/002
author: Shahrukh Khan
date: 2026-03-28
license: MIT
tags:
  - attack.persistence
  - attack.t1505.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_postconf_milter:
    type: EXECVE
    exe|endswith: '/postconf'
    a2|contains:
      - 'smtpd_milters'
      - 'non_smtpd_milters'
      - 'content_filter'
  selection_maincf_write:
    type: PATH
    name|endswith: '/etc/postfix/main.cf'
    nametype: NORMAL

  condition: 1 of selection_*

falsepositives:
  - Legitimate mail-transport-agent configuration changes by administrators (adding spam-filtering or DKIM-signing milters such as opendkim or rspamd) will also match; correlate with change-management windows and known-good milter binaries.

level: high

Related sub-techniques

Explore