Event ID 5140: network share accessed
What Event ID 5140 (network share accessed) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 5140 is written when someone connects to a network share. It is logged once per session, not once per file, so it is far less noisy than file auditing. The share name tells most of the story: a user opening \\fileserver\Finance is business as usual, while a workstation connecting to C$ or ADMIN$ on another workstation usually is not.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject > Account Name | The account that connected. |
| Source Address | The machine it connected from. |
| Share Name | For example \\*\IPC$, \\*\ADMIN$, \\*\C$, \\*\SYSVOL. |
| Share Path | The local folder behind the share. |
| Access Mask | The rights requested. |
What is normal
SYSVOL and NETLOGON on domain controllers from every domain machine, IPC$ for many management tasks, and user file shares from users' own devices.
When Event ID 5140 is suspicious
- ADMIN$ or C$ accessed from a workstation or by a non-admin account.
- One source connecting to admin shares on many hosts in a short time: lateral movement or ransomware staging.
- IPC$ connections from one host to every machine in the domain: share and session enumeration (BloodHound and similar).
- A share access followed by a new service (7045 or 4697) on the same target.
Common false positive: Backup, inventory and deployment tools connect to admin shares on every machine. Their source addresses and service accounts belong on an allow list.
Find Event ID 5140 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 5140
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 5145: Share object access check
- Event ID 4624: Successful logon
- System Event ID 7045: New service installed
- Event ID 4697: Service installed
FAQ
How do I enable Event ID 5140?
Advanced Audit Policy > Object Access > Audit File Share, Success. Turn it on for servers first, where share access matters most.
What is the IPC$ share?
A special share for inter-process communication. Tools use it to talk to remote services over named pipes, which is why attackers and admins both touch it all the time.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.