Access To ADMIN$ Network Share — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems). Source status: test; severity: low. Source dates: 2017-03-04 / 2024-01-16.

{
  "product": "windows",
  "service": "security",
  "definition": "Requirements: The advanced audit policy setting \"Object Access > Audit File Share\" must be configured for Success/Failure"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 7942d656ac9042507e0e94c6de00ec372245666baf82c9c4aacc0de3d1966f83

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Access To ADMIN$ Network Share
id: 098d7118-55bc-4912-a836-dc6483a8d150
status: test
description: Detects access to ADMIN$ network share
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140
author: Florian Roth (Nextron Systems)
date: 2017-03-04
modified: 2024-01-16
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
    definition: 'Requirements: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure'
detection:
    selection:
        EventID: 5140
        ShareName: 'Admin$'
    filter_main_computer_account:
        SubjectUserName|endswith: '$'
    condition: selection and not 1 of filter_*
falsepositives:
    - Legitimate administrative activity
level: low

Original YAML and metadata in JSON

False positives

• Legitimate administrative activity

Source references

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140