Network share accessed. ShareName, ShareLocalPath, SubjectUserName, IpAddress are key.
Lateral movement via SMB admin shares (C$, ADMIN$, IPC$). Tools: PsExec, WMI, Impacket smbclient. Ransomware accesses shares to encrypt files across network. IPC$ = null session / named pipe access required by many attack tools.
Alert: access to C$ or ADMIN$ from non-management systems. Alert: IPC$ from external or unexpected IPs. Baseline share access patterns — anomalous times or sources are high signal.
ShareNameIpAddressSubjectUserNameAccessMask | Tactic | Technique |
|---|---|
| Lateral Movement | SMB/Windows Admin Shares (T1021.002) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Admin Share Access
status: experimental
description: Access to administrative shares from potentially unexpected hosts
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 5140
ShareName|contains:
- 'C$'
- 'ADMIN$'
condition: selection
falsepositives:
- Legitimate remote administration
- IT management tools
level: medium
tags:
- attack.lateral_movement
- attack.t1021.002SecurityEvent
| where EventID == 5140 // A network share object was accessed
| project TimeGenerated, Computer, ShareName, IpAddress, SubjectUserName, AccessMask
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=5140
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A network share object was accessed — add EventData fields: ShareName, IpAddress, SubjectUserName, AccessMask`A network share object was accessed. Network share accessed. ShareName, ShareLocalPath, SubjectUserName, IpAddress are key.
Event 5140 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).
Event 5140 is associated with: SMB/Windows Admin Shares (T1021.002).
Alert: access to C$ or ADMIN$ from non-management systems. Alert: IPC$ from external or unexpected IPs. Baseline share access patterns — anomalous times or sources are high signal.