T1505.002
Transport Agent
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- Linux audit framework (auditd)
- SYSCALL:exim SYSCALL record for exim
- SYSCALL:postfix SYSCALL record for postfix
- SYSCALL:sbin SYSCALL record for sbin
- SYSCALL:sendmail SYSCALL record for sendmail
- SYSCALL:usr SYSCALL record for usr
- SYSCALL:write SYSCALL record for write
- syslog / journald (auth, secure, messages, cron) (the log as a whole)
- Sysmon for Linux
- Windows Application event log (the log as a whole)
- PowerShell logging
- Sysmon