Microsoft has released Security Updates (SUs) for vulnerabilities found in:
Exchange Server 2013
Exchange Server 2016
Exchange Server 2019
SUs are available in a self-extracting auto-elev...
Updated May 08, 2023
Version 22.0
Blog Post
I have executed the script on our on-premise mailboxes (Exchange 2016 CU 23) and it seems some alerts are reported in the CSV report.
It seems like those are false-positive:
"Mailbox","Id","ItemType","Sender","Recipient","Subject","DateReceived","PidLidReminderFileParameter","Cleanup"
"user1@domain","AAMkAD-too-long-AA=","Task","","","Administratif hebdomadaire - Test","31.08.2017 12:54:11",,"N"
"user2@domain","AAMkAD-too-long-AA=","Task","","","Scenarios de tests (acceptation) manquants","06.06.2017 10:16:12",,"N"
"user3@domain","AAMk-too-long-AA=","Calendar","","","Test subject - meeting privé","17.01.2018 09:16:40","reminder.wav","N"
"user4@domain","AA-too-long-AA=","Task","","",,"15.09.2021 10:56:59",,"N"
"user5@domain","AAM-too-long-AA=","Task","","","Organisation Welcome Days","02.02.2022 17:04:23",,"N"
Majority of the reported events are dated 1 year old or more. Also, for "mailto:user3@domain" this is an internal test meeting.
Can I consider those as false-positive?