Windows Security: Access to ADMIN$ network share via Event ID 5140

Alerts on Windows Security event 5140 entries where an access request targets the ADMIN$ share.

FreeUnreviewedSigmalowv1

windows-security-access-to-admin-network-share-via-event-id-5140-098d7118

title: "Windows Security: Access to ADMIN$ network share via Event ID 5140"
id: ac95e4a0-3c5a-4d17-87cd-6411b632b264
status: test
description: This rule flags attempts to access the ADMIN$ administrative network share on Windows systems using Security event ID 5140 with ShareName set to Admin$. Attackers often use administrative shares for credentialed lateral movement and remote file operations, so these accesses can indicate unwanted administrative behavior or intrusion activity. The detection relies on Windows Security auditing telemetry that records object access to file shares, specifically event 5140 details including the subject username and share name.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_admin_share_access.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-04
modified: 2024-01-16
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  service: security
  definition: 'Requirements: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure'
detection:
  selection:
    EventID: 5140
    ShareName: Admin$
  filter_main_computer_account:
    SubjectUserName|endswith: $
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate administrative activity
level: low
license: DRL-1.1
related:
  - id: 098d7118-55bc-4912-a836-dc6483a8d150
    type: derived

What it detects

This rule flags attempts to access the ADMIN$ administrative network share on Windows systems using Security event ID 5140 with ShareName set to Admin$. Attackers often use administrative shares for credentialed lateral movement and remote file operations, so these accesses can indicate unwanted administrative behavior or intrusion activity. The detection relies on Windows Security auditing telemetry that records object access to file shares, specifically event 5140 details including the subject username and share name.

Known false positives

Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.