Event ID 5145: A network share object was checked for access
Written for each file or folder accessed through a share, with the relative path.
- Log
- Security
- Category
- Network share
Why it matters
- Shows exactly which files were touched over the network, such as a tool copied into ADMIN$.
What to check
Check Share Name, Relative Target Name, Accesses and Source Address.
How to turn it on
Advanced Audit Policy: Object Access > Audit Detailed File Share (very noisy on file servers).
MITRE ATT&CK
- T1021.002 SMB/Windows Admin Shares
- T1105 Ingress Tool Transfer