Transport Agent (T1505.002) is a persistence technique. MITRE lists Linux and Windows as platforms. Microsoft Exchange transport agents work on email passing through the transport pipeline, doing jobs such as filtering spam, filtering malicious attachments, journaling or adding a signature to outgoing mail.
How attackers use it
Transport agents are written by developers, compiled to .NET assemblies and registered with the Exchange server. They are invoked at a chosen stage of mail processing. MITRE explains that an adversary can register a malicious agent to gain persistence that is triggered by events the adversary picks.
Such an agent may see every message, yet it can be set to act only on specific ones. MITRE's example is an agent that copies in transit attachments for later exfiltration only when the recipient address matches an entry on the adversary's list. That selectivity keeps it quiet.
How to detect it
MITRE's analytics describe two patterns:
- On Windows, an adversary registers a malicious transport agent DLL, configures it through PowerShell or the Exchange Management Shell, and changes email processing based on rules or headers.
- On Linux mail systems, installing or changing content filters or transport scripts, for example Postfix or Sendmail milters and Exim filters, using shell access or configuration changes.
Watch for new agent registrations, new DLLs in Exchange paths, and configuration edits to mail filters made outside a change process.
How to reduce the risk
MITRE lists three mitigations:
- Privileged Account Management: do not use accounts that can add component software for daily work.
- Audit: regularly check component software on critical services for unexpected changes.
- Code Signing: make sure component binaries are signed by the correct developers.
Check your own environment
In the Exchange Management Shell, this read only command lists registered agents:
Get-TransportAgent
Compare the output to the agents you expect, including their assemblies and whether each is enabled. On Linux mail servers, review milter and filter configuration files and their modification times.
Quick check
How can a transport agent see all mail but still stay hard to notice?
It can be written to act only on messages that match adversary chosen criteria, such as certain recipients, so most mail passes through untouched.
