description: The following analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. It leverages PowerShell ...
description: The following analytic detects the enabling of the SMB1 protocol via `powershell.exe`. It leverages PowerShell script block logging (EventCode 4104) to identify the execution of the ...
Some of our readers complain about seeing the Windows security event 4726 in the Domain Controller. The event log indicates A user account was deleted and other details about the recorded event.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results