Exchange 2013 Get-ServerHealth cmdlet triggers New-AcceptedDomain cmdlet

Question

Our Exchange team recently issue Get-ServerHealth and Get-Messagetrackinglog cmdlets but triggers our SOC to issue Solarigate attack alert to us saying that someone has issued one of the following commands.

 Add-FederatedDomain
 New-AcceptedDomain
 Remove-AcceptedDomain
 Remove-FederatedDomain
 Set-AcceptedDomain

We can repeat the same flow by issuing the Get-ServerHealth and Get-Messagetrackinglog cmdlets again.

One thing I don't understand is that why Get-ServerHealth and Get-Messagetrackinglog cmdlets will trigger one of the above xxxDomain cmdlets. Do anybody know the reason?

Answer 1

Who issues those commands exactly? I ran those two commands (Get-ServerHealth and Get-Messagetrackinglog ) and then checked the admin audit log and I see no entries for any of those:

Add-FederatedDomain
 New-AcceptedDomain
 Remove-AcceptedDomain
 Remove-FederatedDomain
 Set-AcceptedDomain