Windows Event ID 5140: A network share object was accessed
Windows Security Event ID 5140 records access to a network share and is an important source for investigating SMB-based lateral movement, administrative share use, and staging activity.
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-10
Trigger Scenarios
The event is generated when a client accesses a shared resource on the audited host. It indicates share-level access; detailed file operations require additional object-access auditing such as Event ID 5145.
Key Fields
Subject User Name
The authenticated account accessing the share. Service and machine accounts are common, so identity alone should be considered with the share and source context.
Share Name
The accessed share path. Administrative shares such as ADMIN$, C$, and IPC$ often deserve different triage rules from business file shares.
Source Address
The client address that made the SMB connection. It is a key pivot for mapping remote access and potential lateral movement.
Share Local Path
The local path backing the share. This helps classify whether the target exposes a system drive, application directory, or user data.
Common False Positives
- Normal file-server use, software distribution, backup, and endpoint management can generate high volumes.
- Domain controllers and application servers may receive frequent IPC$ and SYSVOL access.
- Administrative shares are commonly used by authorized remote-management tools.
Related Events
MITRE ATT&CK Mapping
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1070.004Indicator Removal: File Deletion
Detection Notes
T1021.002 lateral movement is concrete when Share Name is ADMIN$ or C$ after a Type 3 4624 from a workstation, especially when Source Port is nonzero and 5145 shows Access Mask 0x2 write or 0x10000 delete. ADMIN$ staging followed by 4697 service creation is a remote-execution chain.
SecurityEvent
| where EventID == 5140
| where ShareName has_any ("ADMIN$", "C$", "IPC$")
| project TimeGenerated, Computer, Account, IpAddress, ShareName, ShareLocalPath
| order by TimeGenerated descindex=wineventlog EventCode=5140 Share_Name IN ("*ADMIN$", "*C$", "*IPC$")
| table _time, host, SubjectUserName, Source_Address, Share_Name, Share_Local_PathSubject: Account Name: CORP\jsmith
Share Information: Share Name: \\*\ADMIN$
Share Local Path: C:\Windows
Network Information: Source Address: 10.x.x.x
Source Port: 52133