Event ID 5140: A network share object was accessed
Written when someone connects to a file share, including admin shares such as C$ and ADMIN$.
- Log
- Security
- Category
- Network share
Why it matters
- Connections to ADMIN$ or C$ from workstations are common in lateral movement, for example with PsExec.
What to check
Check Share Name, Source Address and the account.
How to turn it on
Advanced Audit Policy: Object Access > Audit File Share.
MITRE ATT&CK
- T1021.002 SMB/Windows Admin Shares