Microsoft 365 transport agent installed
A custom transport agent was installed or enabled on Exchange.
What it detects
A custom transport agent was installed or enabled on Exchange.
A transport agent runs INSIDE the mail pipeline, before a message reaches the mailbox database. That places attacker code upstream of everything an investigation normally reads: it can read, alter or copy mail with no inbox rule, no forwarding address and no mailbox permission to find afterwards. The usual hunt for a compromised mailbox looks for artefacts this technique never creates.
It is also rare. Legitimate agents are installed at deployment time by a named product (antispam, journaling, signature management), not mid-life on a running tenant, so the base rate is close to zero and a hit deserves immediate attention rather than triage.
MITRE ATT&CK mapping
False positives and triage
A genuine mail-hygiene or signature product being deployed or upgraded is the only common benign cause, and it is verifiable: the agent has a vendor name, a change ticket, and it is installed by the admin who runs that project. Escalate when the agent's name is generic or unfamiliar, when the installing account has no history of Exchange server administration, or when the install follows a suspicious sign-in by the same actor. Note that a transport agent survives a password reset and a mailbox cleanup — if this is confirmed, removing it is part of eviction.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/cloud/m365_transport_agent_installed.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_transport_agent_installed
version: 1.0.0
status: stable
severity: critical
confidence: 0.75
platforms: [application]
mitre_techniques: [T1505.002, T1114]
description: |
A custom transport agent was installed or enabled on Exchange.
A transport agent runs INSIDE the mail pipeline, before a message reaches the
mailbox database. That places attacker code upstream of everything an
investigation normally reads: it can read, alter or copy mail with no inbox rule,
no forwarding address and no mailbox permission to find afterwards. The usual
hunt for a compromised mailbox looks for artefacts this technique never creates.
It is also rare. Legitimate agents are installed at deployment time by a
named product (antispam, journaling, signature management), not mid-life on a
running tenant, so the base rate is close to zero and a hit deserves immediate
attention rather than triage.
match:
provider: Office365
event_action_any:
- Install-TransportAgent
- Enable-TransportAgent
correlation_keys: [user_name]
false_positive_guidance: |
A genuine mail-hygiene or signature product being deployed or upgraded is the only
common benign cause, and it is verifiable: the agent has a vendor name, a change
ticket, and it is installed by the admin who runs that project. Escalate when the
agent's name is generic or unfamiliar, when the installing account has no history
of Exchange server administration, or when the install follows a suspicious sign-in
by the same actor. Note that a transport agent survives a password reset and a
mailbox cleanup — if this is confirmed, removing it is part of eviction.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.