Log Dejargonizer

Windows Security Log · Event 5140

Event 5140: A network share object was accessed

Something connected to a shared folder over the network. Ordinary file access produces enormous volumes of this, but connections to the hidden administrative shares are a different matter — they are how remote administration and lateral movement both work.

Also written as 5140Event ID 5140

What it means for you

On a personal computer

Something on your network opened a shared folder on this PC. Normal if you share files between machines or use a media server.

For an analyst

Filter to the administrative shares — ADMIN$, C$, and IPC$ — and the volume becomes manageable and the signal strong. IPC$ in particular is used by nearly every remote enumeration and lateral movement technique. Pair with 5145 when you need to know which file was touched rather than just which share.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
A network share object was accessed.

Subject:
  Security ID:    CORP\jbrooks
  Account Name:   jbrooks
  Account Domain: CORP
  Logon ID:       0x3E9A11

Network Information:
  Object Type:     File
  Source Address:  192.0.2.44
  Source Port:     49712

Share Information:
  Share Name:       \\*\ADMIN$
  Share Path:       \??\C:\Windows

Access Request Information:
  Access Mask:  0x1
  Accesses:     ReadData (or ListDirectory)

The fields that decide it

Everything else in the log line is context.

ShareName
The share that was accessed.
  • \\*\IPC$The interprocess communication share. Used by legitimate remote administration and by nearly every enumeration and lateral movement tool.
  • \\*\ADMIN$The Windows directory, exposed as a hidden administrative share. Remote execution tooling writes here.
  • \\*\C$The whole system drive, exposed administratively. Rarely needed outside deliberate administration.
  • A named business shareOrdinary file access. The bulk of the volume.
SubjectUserName
The account that connected.
IpAddress
Where the connection came from. A workstation-to-workstation connection is unusual on most networks.
ShareLocalPath
The folder on disk behind the share name.
SubjectLogonId
The session, matching the 4624 that authenticated it.

Ordinary reasons this happens

Most of the time it is one of these.

  • Users opening files on a file server, which produces the overwhelming majority of these.
  • Roaming profiles and folder redirection.
  • Group Policy clients reading SYSVOL and NETLOGON at every refresh.
  • Backup and antivirus software reading shares on a schedule.
  • Administrators legitimately using C$ or ADMIN$ to manage a machine.
  • Deployment tooling copying installers to remote machines.

When it is not ordinary

Lateral movement using administrative shares.

What gives it awayADMIN$ or C$ access from a workstation to another workstation. Administration normally originates from servers or jump boxes.

ATT&CK T1021.002

Remote execution tooling staging a payload.

What gives it awayADMIN$ access immediately followed by a service installation on the same host.

ATT&CK T1570

Enumerating a network before moving through it.

What gives it awayIPC$ connections from one source to a large number of hosts in a short window.

ATT&CK T1135

Collecting files before exfiltration.

What gives it awayOne account accessing shares across many servers that it has never touched before.

ATT&CK T1039

What to do next

  1. Filter to ADMIN$, C$, and IPC$ first. Named business shares are noise for this purpose.
  2. Check the direction. Workstation to workstation is the pattern worth chasing.
  3. Count distinct destinations per source account in a short window. Breadth is what distinguishes enumeration from work.
  4. Correlate with 4697 or 7045 on the destination — share access followed by a service installation is remote execution.
  5. Join on Logon ID to the 4624 to see how the session authenticated.

Queries to run

kql Administrative share access, which is where the signal lives. 
SecurityEvent | where EventID == 5140 and ShareName has_any ('ADMIN$','C$') | project TimeGenerated, Computer, SubjectUserName, IpAddress, ShareName | order by TimeGenerated desc
kql One source reaching many hosts over IPC$ — network enumeration. 
SecurityEvent | where EventID == 5140 and ShareName contains 'IPC$' | summarize hosts = dcount(Computer) by SubjectUserName, IpAddress, bin(TimeGenerated, 30m) | where hosts > 20
splunk 
index=wineventlog EventCode=5140 Share_Name IN ("\\\\*\\ADMIN$","\\\\*\\C$") | stats count by Account_Name src_ip dest

Common questions

What does the share name IPC$ mean?

It is the interprocess communication share, a special share Windows uses for authenticated remote calls rather than for files. Remote management, service control, and named-pipe communication all go through it — as does almost every network enumeration and lateral movement tool, which is why it is worth watching.

Should I worry about ADMIN$ or C$ access?

It depends entirely on direction. Access from a server or jump box used for administration is expected. Access from one workstation to another rarely has a legitimate explanation, and it is the standard way remote execution tools stage a payload before running it.

Why does Event 5140 produce so many events?

Because it fires for every connection to every share, and file servers handle thousands per hour from ordinary work. Collect it filtered to administrative shares rather than in full, or the volume will cost more than the signal is worth.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026