Windows Security 5145 SMB write to Admin Share (C$) by non-machine accounts

title: Windows Security 5145 SMB write to Admin Share (C$) by non-machine accounts
id: b743adce-e241-428e-aeaa-a0a71d3b7f97
status: test
description: This rule identifies Windows Security EventID 5145 where SMB clients write (AccessMask 0x2) to an administrative share ending in C$. It matters because creating or modifying files on administrative shares can be used to stage files for later access and remote actions. The detection relies on the Security log’s share name, access mask, subject username, and the source IP field, filtering out machine-account usernames and loopback traffic.
references:
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml
  - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml
author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Huntrule Team
date: 2020-08-06
modified: 2025-10-17
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName|endswith: C$
    AccessMask: "0x2"
  filter_main_subjectusername:
    SubjectUserName|endswith: $
  filter_optional_local_ip:
    IpAddress: ::1
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b210394c-ba12-4f89-9117-44a2464b9511
    type: derived