A new network share was created.
Attackers create shares to stage data for exfiltration or to provide access to tools from remote systems.
Alert: share creation by non-IT accounts. Alert: shares with broad permissions (Everyone, Authenticated Users with write).
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Exfiltration | Exfiltration Over Alternative Protocol (T1048) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5142 // A network share object was added
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=5142
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A network share object was added — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
A network share object was added. A new network share was created.
Event 5142 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).
Event 5142 is associated with: Exfiltration Over Alternative Protocol (T1048).
Alert: share creation by non-IT accounts. Alert: shares with broad permissions (Everyone, Authenticated Users with write).