Possible Access To ADMIN$ Network Share (via security)

title: Possible Access To ADMIN$ Network Share (via security)
id: 0eeea0d8-3248-55ca-9d62-323ac06329d1
status: stable
description: This rule detects access to ADMIN$ network share
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140
author: Huntrule Team
date: 2026-04-15
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
    definition: 'Requirements: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure'
detection:
    selection:
        EventID: 5140
        ShareName: 'Admin$'
    filter_main_computer_account:
        SubjectUserName|endswith: '$'
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: low