Windows Event ID 5140 — Network Share Accessed
Logged when a network share is accessed. Captures who accessed which share and from where.
MITRE ATT&CK
T1039 · Data from Network Shared Drive
Collection
Why It Matters
Lateral movement often involves accessing admin shares (C$, ADMIN$, IPC$) or file shares for data staging. Mass access to shares from a single host in a short period can indicate ransomware crawling the network.
Key Fields
Investigation Tips
- 1.C$ and ADMIN$ access from a non-admin workstation is always suspicious.
- 2.High volume of share access events from one source in a short time is a ransomware lateral movement indicator.
- 3.Correlate with 4624 Type 3 (network logon) to see the auth event that preceded the share access.
Seeing Event ID 5140 in your own logs? Upload an .evtx file — EventPeeker flags network share accessed automatically, maps it to MITRE ATT&CK, and writes the triage report. No account, files auto-deleted.
Analyze my logs →Related Event IDs
Have Event ID 5140 open in Event Viewer?
In Event Viewer: right-click the event → Copy → Copy Details as XML, then paste it below. Parsing happens entirely in your browser — the event itself is never uploaded or stored, and it is excluded from session recording. We log only the numeric Event ID.
Go deeper: the full PsExec & Remote Execution — Lateral Movement via Admin Shares guide
Builds on this page with the attack chain, step-by-step investigation, immediate containment actions, KQL/Sigma detection queries, and an annotated example log.
Read the PsExec & Remote Execution — Lateral Movement via Admin Shares guide →See Event ID 5140 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects network share accessed patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →