description: The following analytic detects the enabling of the SMB1 protocol via `powershell.exe`. It leverages PowerShell script block logging (EventCode 4104) to identify the execution of the ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results