// REFERENCE
5140 — A network share was accessed
Log: Security
Medium risk
A network share was accessed. Access to C$, ADMIN$ or other administrative shares from workstations is a strong indicator of lateral movement over SMB.
Related tools
Work with this in:
Related
5145
5145 — Network share access was checked 5142
5142 — A network share was added 5143
5143 — A network share was modified 4648
4648 — Logon using explicit credentials
5145 — Network share access was checked 5142
5142 — A network share was added 5143
5143 — A network share was modified 4648
4648 — Logon using explicit credentials
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.