// REFERENCE
5142 — A network share was added
Log: Security
Medium risk
A network share was created. Sharing a folder can be a step to exfiltrate data or stage a payload across the network. Review the shared path and its permissions.
Related tools
Work with this in:
Related
5140
5140 — A network share was accessed 5145
5145 — Network share access was checked 5143
5143 — A network share was modified 4648
4648 — Logon using explicit credentials
5140 — A network share was accessed 5145
5145 — Network share access was checked 5143
5143 — A network share was modified 4648
4648 — Logon using explicit credentials
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.