Last updated 1 year ago
Microsoft\Windows\SMBServer\Security
This event is logged by default
Can be used to hunt for failed authentication attempts over SMB.