SMB1 Protocol Re-enabled

Elgonad .@elgonad

•updated Apr 27, 2026•2•0•131

Detects the use of the Enable-WindowsOptionalFeature cmdlet to reactivate the deprecated and vulnerable SMB1Protocol. Attackers use this to facilitate lateral movement to legacy systems.