Event ID 5145: share object access check
What Event ID 5145 (share object access check) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 5145 is the detailed version of 5140: it records each file or named pipe accessed through a share. That makes it very noisy, and many organisations enable it only on domain controllers and key servers. Where you have it, the Relative Target Name field shows exactly what a remote tool touched, which turns a vague "someone used ADMIN$" into "someone copied PSEXESVC.exe".
The fields that matter
| Field | What it tells you |
|---|---|
| Share Name | The share used, such as \\*\ADMIN$ or \\*\IPC$. |
| Relative Target Name | The file or pipe inside the share. For IPC$ this is the named pipe. |
| Source Address / Account Name | Where it came from and who did it. |
| Accesses | What was requested, for example WriteData (or AddFile). |
| Access Check Results | Whether the access was granted. |
What is normal
Users reading and writing files on departmental shares, and domain machines reading Group Policy files from SYSVOL.
When Event ID 5145 is suspicious
- A write to ADMIN$ of an
.exe(PsExec copiesPSEXESVC.exethis way). - IPC$ with pipe
svcctl: a remote service is being created. - IPC$ with
atsvc: a remote scheduled task. Withwinreg: remote registry access. - IPC$ with
samr,lsarpcorsrvsvcfrom one workstation to many hosts: account and session enumeration. - One account writing or renaming large numbers of files across shares in minutes: ransomware.
Common false positive: Endpoint management and backup tools use svcctl and admin shares legitimately. So do domain controllers among themselves.
Find Event ID 5145 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5145; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 5145
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 5140: Network share accessed
- Event ID 4697: Service installed
- System Event ID 7045: New service installed
- Event ID 4698: Scheduled task created
FAQ
How do I enable Event ID 5145?
Advanced Audit Policy > Object Access > Audit Detailed File Share. Expect a large volume; test it on a few servers and check your log size first.
Why do I see 5145 events for files nobody opened?
Explorer and many programs check access to files and folders while browsing. A check is not the same as reading the file.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.