Windows Event ID 5140 — Network Share Accessed
Logged when a network share is accessed. Captures who accessed which share and from where.
MITRE ATT&CK
Technique
T1039 · Data from Network Shared Drive
Tactic
Collection
Why It Matters
Lateral movement often involves accessing admin shares (C$, ADMIN$, IPC$) or file shares for data staging. Mass access to shares from a single host in a short period can indicate ransomware crawling the network.
Key Fields
Share NameWhich share was accessed — C$ and ADMIN$ are high-value targets
Source AddressThe client IP accessing the share
Account NameThe authenticated account
Investigation Tips
- 1.C$ and ADMIN$ access from a non-admin workstation is always suspicious.
- 2.High volume of share access events from one source in a short time is a ransomware lateral movement indicator.
- 3.Correlate with 4624 Type 3 (network logon) to see the auth event that preceded the share access.
Go deeper: the full PsExec & Remote Execution — Lateral Movement via Admin Shares guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the PsExec & Remote Execution — Lateral Movement via Admin Shares guide →See Event ID 5140 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →