Windows Event ID 5145: A network share object was checked for access
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 5145 records that Windows evaluated a client's access request against a network share object, logging the share name, relative target path, client identity, source IP, and the access mask requested or denied.
Technical Metadata
| Event ID | 5145 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success or Audit Failure |
| MITRE ATT&CK | TA0008 Lateral Movement / T1021.002 SMB/Windows Admin Shares |
| Key fields to watch | Share Name, Relative Target Name, Access Mask, Network Information\Source Address / Source Port |
Trigger Scenarios
This event fires for every SMB file or directory access check on audited shares. It is extremely high-volume on file servers and is usually filtered in production to administrative shares (ADMIN$, C$, IPC$), failure events, or specific high-value share paths. Attack-relevant scenarios include lateral movement via PsExec or Impacket, ransomware staging, and credential-file access via SYSVOL.
Key Fields
Share Name
The UNC name of the accessed share. ADMIN$, C$, and IPC$ are administrative shares used by remote management protocols and lateral movement tools; access to these by non-administrative accounts or from unusual sources is a T1021.002 indicator.
Relative Target Name
The path to the specific file or directory within the share. A RelativeTargetName ending in .exe or .dll under ADMIN$ or C$ is the PsExec/Impacket binary-staging pattern for lateral movement. A path like Policies\...\Groups.xml under SYSVOL indicates Group Policy Preferences credential harvesting.
Access Mask
Bitmask of the requested operations. Key values: 0x2 (WriteData/AddFile) means write access — the attacker is dropping a file; 0x10000 (DELETE) means deletion; 0x40000 (WRITE_DAC) and 0x80000 (WRITE_OWNER) mean ACL modification. Microsoft recommends alerting on these values on failure events particularly for WriteData, AppendData, WriteEA, DeleteChild, WriteAttributes, DELETE, WRITE_DAC, and WRITE_OWNER.
Network Information\Source Address / Source Port
The IP address and port of the client. A source IP not in the expected administrative subnet accessing ADMIN$ or C$ is a concrete indicator of unauthorized lateral movement rather than routine administration.
Threat Hunting Queries
SecurityEvent
| where EventID == 5145
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
index=wineventlog source="WinEventLog:Security" EventCode=5145
| table _time, host, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 5145- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security or applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 5145
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5145
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| AccessMask | 0x2 | WriteData/AddFile access to the share object. | Use AccessMask together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
| AccessMask | 0x40000 | WRITE_DAC permission to modify the object's DACL. | Use AccessMask together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1021.002SMB/Windows Admin Shares
Detection Notes
T1021.002 SMB/Windows Admin Shares activity is supported when AccessMask includes 0x2 (WriteData/AddFile) and ShareName is ADMIN$ or C$ while RelativeTargetName identifies an executable or DLL. Microsoft also identifies 0x4 (AppendData), 0x10 (WriteEA), 0x40 (DeleteChild), 0x100 (WriteAttributes), 0x10000 (DELETE), 0x40000 (WRITE_DAC), and 0x80000 (WRITE_OWNER) as write, delete, or permission-changing access worth monitoring on failures. Correlate SourceAddress and SubjectLogonId with Event 4624 LogonType=3, then verify whether the source host and account are approved for remote administration.
Common False Positives
- Backup agents, antivirus scanners, and SCCM/Intune management traffic legitimately access administrative shares at high frequency.
- DFS replication and Windows Update processes access specific share paths under ADMIN$.
- Help-desk remote support tools that use ADMIN$ for file staging during troubleshooting.
Related Events
Sample Log
Subject:
Security ID: CORP\jsmith
Account Name: jsmith
Account Domain: CORP
Logon ID: 0x5BE120
Network Information:
Source Address: 10.10.20.55
Source Port: 49155
Share Information:
Share Name: \\DC01\ADMIN$
Share Path: C:\Windows
Relative Target Name: PSEXESVC.exe
Access Information:
Access Mask: 0x2
Accesses: WriteData (or AddFile)Frequently Asked Questions
What does Windows Event ID 5145 mean?
Windows evaluated access to a file or folder through a network share.
Does Event ID 5145 always indicate malicious activity?
No. File-server and administrative activity can generate it; evaluate share, path, access mask, account, and source address.
How should Event ID 5145 be investigated?
Correlate SubjectLogonId with Event 4624 Logon Type 3 and inspect writes to ADMIN$, C$, and unusual share paths.
Sources
- 5145: A network share object was checked for access
Microsoft · vendor
- SMB/Windows Admin Shares (T1021.002)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule