We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log.
I know Exchange Server 2013 CU5, CU5 includes a Managed Availability probe configuration that is frequently restarting the Microsoft Exchange Shared Cache Service in some environments. The service is being added to provide future performance improvements and is not used in Cumulative Update 5. More information is available in KB2971467
So it looks like this event triggered alarm is a false-positive. Anyone else experience this?
http://schemas.microsoft.com/win/2004/08/events/event'>46490InformationOther Logon/Logoff EventsInfoAudit Failure79125070SecurityDOMAINA replay attack was detected.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tNT AUTHORITY\SYSTEM\r\n\tAccount Name:\t\tSERVERNAME$\r\n\tAccount Domain:\t\tDOMAIN\r\n\tLogon ID:\t\t0x3E7\r\n\r\nCredentials Which Were Replayed:\r\n\tAccount Name:\t\tHealthMailboxXXXXX\r\n\tAccount Domain:\t\tDOMAIN\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x673b81d620\r\n\tProcess Name:\t\tC:\Windows\System32\inetsrv\w3wp.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\r\nDetailed Authentication Information:\r\n\tRequest Type:\t\tKRB_AP_REQ\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\r\nThis event indicates that a Kerberos replay attack was detected- a request was received twice with identical information. This condition could be caused by network misconfiguration.