Windows Event ID 5140: A network share object was accessed
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 5140 records access to a network share and is an important source for investigating SMB-based lateral movement, administrative share use, and staging activity.
Technical Metadata
| Event ID | 5140 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success or Audit Failure |
| MITRE ATT&CK | TA0008 Lateral Movement / T1021.002 Remote Services: SMB/Windows Admin Shares |
| Key fields to watch | Subject User Name, Share Name, Source Address, Share Local Path |
Trigger Scenarios
The event is generated when a client accesses a shared resource on the audited host. It indicates share-level access; detailed file operations require additional object-access auditing such as Event ID 5145.
Key Fields
Subject User Name
The authenticated account accessing the share. Service and machine accounts are common, so identity alone should be considered with the share and source context.
Share Name
The accessed share path. Administrative shares such as ADMIN$, C$, and IPC$ often deserve different triage rules from business file shares.
Source Address
The client address that made the SMB connection. It is a key pivot for mapping remote access and potential lateral movement.
Share Local Path
The local path backing the share. This helps classify whether the target exposes a system drive, application directory, or user data.
Threat Hunting Queries
SecurityEvent
| where EventID == 5140
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=5140
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 5140- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 5140
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5140
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| ShareName | \\*\ADMIN$ | The hidden administrative share maps to the Windows directory on the target computer. | Unexpected remote access followed by file creation or service installation is a stronger lateral-movement sequence than share access alone. Source |
| ShareName | \\*\C$ | The hidden administrative share exposes the root of the system drive to authorized administrators. | Access from an unusual source or account should be correlated with 5145 requested rights and subsequent file or process activity. Source |
MITRE ATT&CK Mapping
- T1021.002Remote Services: SMB/Windows Admin Shares
Detection Notes
T1021.002 lateral movement is concrete when Share Name is ADMIN$ or C$ after a Type 3 4624 from a workstation, especially when Source Port is nonzero and 5145 shows Access Mask 0x2 write or 0x10000 delete. ADMIN$ staging followed by 4697 service creation is a remote-execution chain.
Common False Positives
- Normal file-server use, software distribution, backup, and endpoint management can generate high volumes.
- Domain controllers and application servers may receive frequent IPC$ and SYSVOL access.
- Administrative shares are commonly used by authorized remote-management tools.
Related Events
Sample Log
Subject: Account Name: CORP\jsmith
Share Information: Share Name: \\*\ADMIN$
Share Local Path: C:\Windows
Network Information: Source Address: 10.x.x.x
Source Port: 52133Frequently Asked Questions
What does Windows Event ID 5140 mean?
Event ID 5140 records that a network share object was accessed and is generated once per session on the computer hosting the share.
Does Event ID 5140 show the accessed file?
No. It identifies the share and connection context; event 5145 provides per-access checks with relative target names and requested access rights when detailed file-share auditing is enabled.
Are ADMIN$ and C$ accesses always malicious?
No. Administration, software deployment, backup, and monitoring tools use these shares; investigate unexpected accounts, source addresses, timing, written files, and follow-on service or task creation.
Sources
- 5140: Microsoft Windows security auditing event reference
Microsoft · vendor
- Remote Services: SMB/Windows Admin Shares (T1021.002)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule