AN0472
Analytic 0472
Windows
Adversary registers a malicious Microsoft Exchange transport agent DLL (.NET assembly), configures it via PowerShell or Exchange Management Shell, and persists code execution by manipulating email processing logic based on rules or headers.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=7
WinEventLog:Application
Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution
WinEventLog:Sysmon
EventCode=11
[TimeWindow]
May need tuning based on frequency of Exchange agent updates in environment.
[AssemblyPath]
Specific DLL paths used by Exchange for registered agents may vary between deployments.
[CmdletInvocationThreshold]
Tunable threshold for repeated use of transport agent management cmdlets.
AN0473
Analytic 0473
Linux
Adversary installs or modifies email content filters or transport scripts (e.g., Postfix milter, Sendmail milter, Exim filters) using shell access or configuration manipulation.
auditd:SYSCALL
write
linux:syslog
milter configuration updated, transport rule initialized, unexpected script execution
auditd:EXECVE
/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail
auditd:SYSCALL
write
linux:Sysmon
EventCode=7
[MailTransportScriptPath]
Path to custom scripts or filters depends on mail daemon (e.g., /etc/postfix/milter/, /etc/exim4/).
[UserContext]
Mail agents may run under different service users (postfix, exim, etc.), which should be scoped.
[ExecFrequencyThreshold]
Frequency of filter script re-execution per daemon restart or reload may vary.