1200KM / detection
T1505.002 Transport Agent — Detection Rules
Detection workspace for T1505.002 Transport Agent: 3 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- MSExchange Transport Agent Installation - Builtin · test · medium · {"product":"windows","service":"msexchange-management"}
- Failed MSExchange Transport Agent Installation · test · high · {"service":"msexchange-management","product":"windows"}
- MSExchange Transport Agent Installation · test · medium · {"product":"windows","category":"process_creation"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0166 Detection Strategy for T1505.002 - Transport Agent Abuse (Windows/Linux)
AN0472 Analytic 0472
Adversary registers a malicious Microsoft Exchange transport agent DLL (.NET assembly), configures it via PowerShell or Exchange Management Shell, and persists code execution by manipulating email processing logic based on rules or headers.
AN0473 Analytic 0473
Adversary installs or modifies email content filters or transport scripts (e.g., Postfix milter, Sendmail milter, Exim filters) using shell access or configuration manipulation.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1505.002 simulation workspace
- Application Log Content · DC0038
- Command Execution · DC0064
- File Creation · DC0039
- File Modification · DC0061
- Module Load · DC0016
- Process Creation · DC0032
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.