huntrule

Windows Security 5145 Network Share Access to Sensitive File Extensions

Alerts when Windows users access network-shared files with extensions commonly targeted for credential or data collection.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
Samir Bousseaden (SigmaHQ), DRL 1.1
Published
2019-04-03
Updated
2026-07-31
AnalysisDetection
title: Windows Security 5145 Network Share Access to Sensitive File Extensions
id: a35e29fb-003b-435e-be57-840f2bd70043
related:
  - id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc
    type: similar
  - id: 91c945bc-2ad1-4799-a591-4d00198a1215
    type: derived
status: test
description: This rule flags Windows Security Event ID 5145 when an account accesses files on a network share with extensions commonly used for sensitive data and credentials. Attackers may search for and exfiltrate or stage valuable artifacts such as mailbox stores, backup files, crash dumps, directory/credential-related exports, and other high-value formats. It relies on Windows file share auditing telemetry capturing the target filename via RelativeTargetName ending in one of the listed extensions.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-04-03
modified: 2025-10-17
tags:
  - attack.collection
  - attack.t1039
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    RelativeTargetName|endswith:
      - .bak
      - .dmp
      - .edb
      - .kirbi
      - .msg
      - .nsf
      - .nst
      - .oab
      - .ost
      - .pst
      - .rdp
  condition: selection
falsepositives:
  - Help Desk operator doing backup or re-imaging end user machine or backup software
  - Users working with these data types or exchanging message files
level: medium
license: DRL-1.1