Last updated 9 months ago
Microsoft\Windows\SMBServer\Security
This event is logged by default
Can be used to hunt for failed authentication attempts over SMB.