Access To ADMIN$ Network Share

Title: Access To ADMIN$ Network Share
Status: test
Description:Detects access to ADMIN$ network share
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140
Author: Florian Roth (Nextron Systems)
Date: 2017-03-04
modified:2024-01-16
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• product: windows
• service: security
• definition: Requirements: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure

Detection:
  selection:
    EventID: '5140'
    ShareName: 'Admin$'
  filter_main_computer_account:
    SubjectUserName|endswith: '$'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Legitimate administrative activity
Level: low