tfMITRE ATT&CK sub-technique

Transport Agent T1505.002

sub-technique of T1505 Server Software Component

Tactic: Persistence
Platforms: Linux, Windows
Version: 1.1
Created: 12 December 2019
Last modified: 24 October 2025
Contributors: ESET; Christoffer Strömblad

Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.[1][2] Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Transport Agent MITRE reference T1505.002

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LightNeuronS0395 ↗

Has used a malicious Microsoft Exchange transport agent for persistence.1

created 2019-06-28MALWAREcarried by 1 group

All 1 software entries for this technique

Offense vs defense T1505.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0

first rule: 2021 Q2

Transport Agent detection strategy DET0166

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1505.002 - Transport Agent Abuse (Windows/Linux)

Enterprise

2 platforms

AN0472 · Windows

Adversary registers a malicious Microsoft Exchange transport agent DLL (.NET assembly), configures it via PowerShell or Exchange Management Shell, and persists code execution by manipulating email processing logic based on rules or headers.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	WinEventLog:Application	Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	May need tuning based on frequency of Exchange agent updates in environment.
AssemblyPath	Specific DLL paths used by Exchange for registered agents may vary between deployments.
CmdletInvocationThreshold	Tunable threshold for repeated use of transport agent management cmdlets.

AN0473 · Linux

Adversary installs or modifies email content filters or transport scripts (e.g., Postfix milter, Sendmail milter, Exim filters) using shell access or configuration manipulation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	linux:Sysmon	EventCode=7
Process CreationDC0032	auditd:EXECVE	/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail
Application Log ContentDC0038	linux:syslog	milter configuration updated, transport rule initialized, unexpected script execution
File CreationDC0039	auditd:SYSCALL	write
File ModificationDC0061	auditd:SYSCALL	write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MailTransportScriptPath	Path to custom scripts or filters depends on mail daemon (e.g., /etc/postfix/milter/, /etc/exim4/).
UserContext	Mail agents may run under different service users (postfix, exim, etc.), which should be scoped.
ExecFrequencyThreshold	Frequency of filter script re-execution per daemon restart or reload may vary.

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Install MS Exchange Transport Agent Persistence

windows

PowerShell

Required

Yes

Install a Microsoft Exchange Transport Agent for persistence. This requires execution from an Exchange Client Access Server and the creation of a DLL with specific exports. Seen in use by Turla. More details- https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help

Input arguments

Name	Type	Default	Description
dll_path	path	c:\program files\microsoft\Exchange Server\v15\bin\Microsoft.Exchange.Security.Interop.dll	Path of DLL to use as transport agent.
class_factory	string	Microsoft.Exchange.Security.Interop.SecurityInteropAgentFactory	Class factory of transport agent.
transport_agent_identity	string	Security Interop Agent	Friendly name of transport agent once installed.

Attack command

Install-TransportAgent -Name #{transport_agent_identity} -TransportAgentFactory #{class_factory} -AssemblyPath #{dll_path}
Enable-TransportAgent #{transport_agent_identity}
Get-TransportAgent | Format-List Name,Enabled

Cleanup command

if(Get-Command "Get-TransportAgent" -ErrorAction Ignore){
  Disable-TransportAgent #{transport_agent_identity}
  Uninstall-TransportAgent #{transport_agent_identity}
  Get-TransportAgent
}

Prerequisite

Microsoft Exchange SnapIn must be installed

Check

Get-TransportAgent -TransportService FrontEnd

Satisfy

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

GUIDd29ed67a-d31d-4290-bc0c-86d4b5c0ce82

Tests from Atomic Red Team (MIT licence) · technique definition

Transport Agent detections T1505.002

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs