Detect Transport Agent in Google Chronicle
Adversaries abuse Microsoft Exchange transport agents to establish persistent access and intercept email traffic. Transport agents are .NET assemblies registered with Exchange that process all email passing through the transport pipeline. Turla's LightNeuron malware is the canonical example — registered as a transport agent on Exchange, it intercepted and exfiltrated email content and received commands via steganographic images in email attachments, achieving complete mailbox surveillance.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Sub-technique
- T1505.002 Transport Agent
- Canonical reference
- https://attack.mitre.org/techniques/T1505/002/
YARA-L Detection Query
rule exchange_transport_agent_persistence {
meta:
author = "Argus Detection Engineering"
description = "Detects Exchange transport agent (T1505.002) persistence: DLL drops to transport directories, OS commands from transport processes, or PowerShell agent installation cmdlets"
mitre_attack_tactic = "Persistence"
mitre_attack_technique = "T1505.002"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://attack.mitre.org/techniques/T1505/002/"
events:
(
$e.metadata.event_type = "FILE_CREATION" and
re.regex($e.target.file.full_path,
`(?i)(\\Microsoft\\Exchange Server\\|\\Exchange Server\\|\\v15\\Bin\\|\\TransportRoles\\|\\FrontEnd\\TransportAgent\\)`) and
re.regex($e.target.file.full_path, `(?i)\.dll$`) and
not re.regex($e.principal.process.file.full_path,
`(?i)(exsetup|updateexchangesetup|ExchangeSetup|msiexec|setup)\.exe$`)
) or
(
$e.metadata.event_type = "PROCESS_LAUNCH" and
re.regex($e.principal.process.file.full_path,
`(?i)(EdgeTransport|MSExchangeTransport)\.exe$`) and
re.regex($e.target.process.file.full_path,
`(?i)(cmd|powershell|wscript|cscript|certutil|bitsadmin|mshta|rundll32|net)\.exe$`)
) or
(
$e.metadata.event_type = "PROCESS_LAUNCH" and
re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
re.regex($e.target.process.command_line,
`(?i)(Install-TransportAgent|Enable-TransportAgent|New-TransportAgentConnector|Set-TransportAgent)`)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting Exchange transport agent persistence using UDM normalized events. Matches FILE_CREATION events where DLLs are written to Exchange transport paths by non-installer processes, PROCESS_LAUNCH events where EdgeTransport.exe or MSExchangeTransport.exe spawn interpreter or LOLBIN processes, and PROCESS_LAUNCH events where PowerShell executes transport agent management cmdlets. Covers LightNeuron implant deployment patterns documented by ESET.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Exchange transport agent software vendors (e.g., GFI MailEssentials, Hornetsecurity) deploying updates that write DLLs to Exchange transport directories outside of the standard Exchange setup process
- Exchange hybrid deployment wizard or Microsoft Exchange Hybrid Configuration Tool spawning PowerShell with Set-TransportAgent or similar cmdlets during hybrid connector configuration
- Automated Exchange health monitoring or management scripts running under the Exchange Trusted Subsystem that execute PowerShell commands as child processes of transport service components
Other platforms for T1505.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1List Installed Transport Agents (Detection Audit)
Expected signal: Sysmon EventCode 1: powershell.exe with CommandLine containing 'Get-TransportAgent'. Exchange admin audit log: Get-TransportAgent cmdlet execution.
- Test 2Simulate Transport Agent DLL Drop (File Write Test)
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename containing 'TransportRoles\agents\df00tech-test-agent.dll' and Image=powershell.exe.
- Test 3Check Exchange Admin Audit Log for Transport Agent Commands
Expected signal: Sysmon EventCode 1: powershell.exe with CommandLine containing 'Search-AdminAuditLog'. Exchange admin audit log query event.
References (4)
Unlock Pro Content
Get the full detection package for T1505.002 including response playbook, investigation guide, and atomic red team tests.