SMB1 Protocol Re-enabled via CommandLine

Tim Peck@timpeck

•updated Apr 20, 2026•8•0•314

Detects the use of PowerShell to re-enable the deprecated and vulnerable SMB1 protocol. This protocol is often used by attackers for lateral movement to legacy systems, as highlighted by groups like The Gentlemen RaaS.