0

We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log.

I know Exchange Server 2013 CU5, CU5 includes a Managed Availability probe configuration that is frequently restarting the Microsoft Exchange Shared Cache Service in some environments. The service is being added to provide future performance improvements and is not used in Cumulative Update 5. More information is available in KB2971467

So it looks like this event triggered alarm is a false-positive. Anyone else experience this?

http://schemas.microsoft.com/win/2004/08/events/event'>46490InformationOther Logon/Logoff EventsInfoAudit Failure79125070SecurityDOMAINA replay attack was detected.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tNT AUTHORITY\SYSTEM\r\n\tAccount Name:\t\tSERVERNAME$\r\n\tAccount Domain:\t\tDOMAIN\r\n\tLogon ID:\t\t0x3E7\r\n\r\nCredentials Which Were Replayed:\r\n\tAccount Name:\t\tHealthMailboxXXXXX\r\n\tAccount Domain:\t\tDOMAIN\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x673b81d620\r\n\tProcess Name:\t\tC:\Windows\System32\inetsrv\w3wp.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\r\nDetailed Authentication Information:\r\n\tRequest Type:\t\tKRB_AP_REQ\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\r\nThis event indicates that a Kerberos replay attack was detected- a request was received twice with identical information. This condition could be caused by network misconfiguration.

bumped to the homepage by Community 2 days ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

0

One item to check is whether or not a result is false positive. The final portion of the log states a caution of the results:

This event indicates that a Kerberos replay attack was detected
- a request was received twice with identical information.
This condition could be caused by network misconfiguration.

Microsoft help docs at https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4649 also recommend doing a manual investigation as part of checking to see if this is a false positive.

I've done scans that have ended up with false positive and needed additional checks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.