Weird alert by CIS

CIS’s alerted that c:\powershell*something* was done something but no such folder in c’s root and that alert isn’t shown anywhere in CIS alerts now in Win10’s taskbar alerts so I have no clue what alert tried to told me and what CIS actually did IF it did something.

Check CIS logs (HIPS, Firewall, Alerts).

That’s what I did (all logs besides Trusted thingies) and even checked Event viewer CIS logs but its not shown anywhere. It was clearly CIS alert (or notification).

Apparently its alert due powershell script tries (w/o anything shown to user) to disable smb1 (no smb any version should be installed since no server) and atm ps-script is in tempscrpt-folder (actually 2 ps-scripts written to do same). CIS FW asked if script is allowed to contact conhost.exe.