Log Dejargonizer

Windows Security Log · Event 5145

Event 5145: Detailed file share access

Someone reached a specific file or pipe over a network share, and Windows recorded exactly which one and what access they asked for. It is enormously noisy — and it is also the clearest view you can get of remote execution tooling and share enumeration.

Also written as Event ID 5145A network share object was checkeddetailed file share auditing5145 share access

What it means for you

On a personal computer

Enterprise auditing that is off by default. A home PC will not produce it.

For an analyst

Requires the Detailed File Share subcategory, which is separate from File Share and off by default for good reason — a file server generates enormous volume. Enable it selectively. The value is the RelativeTargetName field: named pipes such as svcctl, atsvc, and winreg are how remote service control, scheduled tasks, and registry access actually work over SMB, and they are what remote execution tooling leaves behind.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
A network share object was checked to see whether client can be granted desired access.

Subject:
  Security ID:    CORP\jbrooks
  Account Name:   jbrooks
  Account Domain: CORP
  Logon ID:       0x3E9A11

Network Information:
  Object Type:    File
  Source Address: 192.0.2.44
  Source Port:    49712

Share Information:
  Share Name:     \\*\IPC$
  Share Path:     
  Relative Target Name: svcctl

Access Request Information:
  Access Mask:  0x12019f
  Accesses:     ReadData (or ListDirectory)
                WriteData (or AddFile)

The fields that decide it

Everything else in the log line is context.

ShareName
The share reached. IPC$ carries the named pipes and is where the interesting entries live.
RelativeTargetName
The specific file or named pipe inside the share. This is the field that matters.
  • svcctlRemote service control. How remote execution tools create and start their service.
  • atsvcRemote scheduled task manipulation.
  • winregRemote registry access.
  • samrQueries the account database — used to enumerate users and groups remotely.
  • lsarpcLocal security authority queries, used for enumeration.
  • srvsvcShare enumeration. Legitimate for browsing, and the first thing many tools do.
  • An ordinary document pathNormal file access, and nearly all of the volume.
IpAddress
Where the connection came from. Workstation to workstation is the direction to chase.
SubjectUserName
The account that made the request.
AccessMask
The access requested, as a hexadecimal mask.
AccessList
The access rights in readable form, such as ReadData or WriteData.

Ordinary reasons this happens

Most of the time it is one of these.

  • Ordinary file access on a file server, which is the overwhelming majority.
  • Group Policy clients reading SYSVOL at every refresh.
  • Roaming profiles and folder redirection.
  • Backup and antivirus software reading files on a schedule.
  • Legitimate remote administration, which uses exactly the same named pipes attackers do.
  • Software deployment tooling copying installers and creating services remotely.

When it is not ordinary

Remote command execution over SMB.

What gives it awayRelativeTargetName svcctl, usually preceded by a write to ADMIN$ and followed by a service installation on the target.

ATT&CK T1569.002

Remote scheduled task creation.

What gives it awayRelativeTargetName atsvc, which is how a task is registered on a remote machine.

ATT&CK T1053.005

Remote registry access.

What gives it awayRelativeTargetName winreg from a source that does not administer that host.

ATT&CK T1012

Account and group enumeration.

What gives it awayRelativeTargetName samr or lsarpc, often from one source against many hosts in a short window.

ATT&CK T1087.002

Share discovery before moving.

What gives it awayRelativeTargetName srvsvc across a large number of destinations.

ATT&CK T1135

What to do next

  1. Filter to ShareName IPC$ and look at RelativeTargetName first. That is where the signal is.
  2. Treat svcctl and atsvc as remote execution until shown otherwise, then find what ran on the target.
  3. Check the direction — workstation to workstation rarely has a legitimate explanation.
  4. Count distinct destinations per source in a short window. Breadth separates enumeration from work.
  5. Correlate with 7045 or 4697 on the destination; pipe access followed by a service installation is the full pattern.
  6. Baseline your own deployment and administration tooling first, or this will bury you.

Queries to run

kql The named pipes that carry remote execution and enumeration. Short list once your own tooling is excluded. 
SecurityEvent | where EventID == 5145 and RelativeTargetName in~ ('svcctl','atsvc','winreg','samr') | project TimeGenerated, Computer, SubjectUserName, IpAddress, RelativeTargetName | order by TimeGenerated desc
kql Share enumeration across many hosts from one source. 
SecurityEvent | where EventID == 5145 and RelativeTargetName =~ 'srvsvc' | summarize hosts = dcount(Computer) by SubjectUserName, IpAddress, bin(TimeGenerated, 30m) | where hosts > 20
kql Writes to an administrative share — the payload-staging half of remote execution. 
SecurityEvent | where EventID == 5145 and ShareName has_any ('ADMIN$','C$') and AccessList has 'WriteData' | project TimeGenerated, Computer, SubjectUserName, IpAddress, RelativeTargetName
splunk 
index=wineventlog EventCode=5145 Relative_Target_Name IN ("svcctl","atsvc","winreg") | stats count by Account_Name src_ip dest Relative_Target_Name

Common questions

Why is Event 5145 not appearing in my logs?

It needs the Detailed File Share audit subcategory, which is separate from File Share and disabled by default. Enable it with `auditpol /set /subcategory:"Detailed File Share" /success:enable`. Be deliberate about where — on a busy file server it generates an enormous volume.

What are svcctl and atsvc in Event 5145?

Named pipes. svcctl is the remote service control interface — creating and starting a service on another machine goes through it, which is exactly how remote execution tools work. atsvc is the remote scheduled task interface. Both have legitimate administrative uses, so what matters is which machines are talking and in which direction.

What is the difference between Event 5140 and Event 5145?

5140 records a connection to a share. 5145 records access to a specific object inside it. 5140 tells you someone reached ADMIN$; 5145 tells you they touched svcctl, which is a much more specific and more actionable statement.

How do I use Event 5145 to detect lateral movement without drowning in noise?

Do not collect it wholesale. Filter to ShareName IPC$ and to the handful of named pipes that carry remote execution and enumeration — svcctl, atsvc, winreg, samr, srvsvc. That reduces the volume by orders of magnitude and keeps almost all of the signal.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026