Event ID 5140 records access to a network share object. It can show reconnaissance, staging of tools, or access to sensitive files on exposed shares. Review the share name, source address and account name to confirm whether the access was expected and whether the account should reach that share.
What Event ID 5140 usually tells you about attacker activity
Event ID 5140 is not an exploit alert by itself, but it often appears during the early or mid stages of an intrusion. The event records access to a network share object, so it can reflect a normal business workflow, or it can show an attacker probing the environment for readable shares, staging tooling, or checking whether a target account can reach sensitive file locations.
That makes the event useful as a context signal. A single 5140 on a common share may be routine, while repeated hits across unusual shares, especially from one source address or one account, can point to reconnaissance or lateral movement preparation. The key question is whether the access pattern matches the user and the workstation, not just whether the share was touched.
For a broader view of how share access sits inside Windows telemetry, the Windows Event Log Guide is useful because it places 5140 alongside other logon, file access and account activity events that help you separate routine access from suspicious enumeration or staging.
How to interpret the share, source and account together
The most reliable way to read 5140 is to treat the share name, source address and account name as a triad. The share name tells you what was touched, the source address tells you where the request came from, and the account name tells you who or what had the effective access. If any one of those looks out of place, the event becomes more interesting than the raw count alone.
Share access to administrative locations, backup paths, home folders, software distribution shares, or ad hoc staging directories deserves more scrutiny than access to a well-known business share. The same is true when the source address belongs to an unexpected host class, such as a workstation that should not be reading file shares in bulk, or when the account is a service account that does not normally browse file content interactively.
Repeated or patterned share access can also be an operational sign of collection and staging. That is especially true if the same account touches several shares in a short window, if the source system is new to that activity, or if the access happens soon after a suspicious logon or remote execution event. For defenders, the value is in correlation, not in the event standing alone.
What makes 5140 suspicious enough to investigate
The event becomes materially suspicious when the access is inconsistent with the account’s purpose, the host’s role, or the timing of other activity. Access to sensitive shares from non-admin endpoints, access outside normal business hours, and access from accounts that should not need file browsing are common signals that warrant review. The same is true when 5140 is paired with later file reads, archive creation, or process execution on the same machine.
Attackers often use file share discovery to learn where data lives before they try to copy it. They may also use shares to place tools, scripts or payloads in locations that are already trusted by other systems. If you see 5140 followed by unusual file creation, service execution, or remote administration behavior, treat the share access as part of a larger attack path rather than a standalone file event.
The CISA cyber threat advisories page is a good external reference point when you want to map share access behavior to active threat patterns, especially when the event is part of a suspected intrusion chain rather than an isolated anomaly.
Risk and Threat Considerations
Event ID 5140 matters because network shares often expose data and tooling that attackers can read without first triggering obvious application controls. If share permissions are too broad, the event may reveal that an account can reach sensitive material far beyond its intended role, which creates both confidentiality risk and lateral movement opportunity.
Failure mechanism: An attacker, or a compromised account, uses legitimate share access to enumerate content, stage tools, or collect sensitive files without needing to exploit the file server itself.
Impact: This can lead to data exposure, faster internal movement, and a clearer path to follow-on actions such as staging, exfiltration, or persistence on systems that trust the share.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1135 — Network Share Discovery | Share access can reflect discovery of reachable internal shares. |
| T1021 — Remote Services | Share access often precedes or supports remote internal movement. | |
| Recommendation — Map suspicious share enumeration to T1135 and hunt for follow-on lateral movement. Correlate unusual share access with remote-service activity and constrain internal pathways. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Investigating 5140 depends on validating whether the account should reach the share. |
| Recommendation — Review and remove unnecessary share access rights for accounts that do not need them. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | 5140 is an audit record used to detect suspicious share access patterns. |
| AC-6 — Least Privilege | Suspicious 5140 events often expose excessive share permissions. | |
| Recommendation — Ensure share-access auditing is enabled and retained for investigation and correlation. Limit share reach to the minimum access each account requires. | ||
Practitioner Guidance
What to verify: Confirm whether the source host, share path and account are expected together. If any one element is unfamiliar, check whether the access aligns with that account’s normal business purpose and whether the share should have been reachable at all.
Decision rule: If the share contains sensitive data or tools and the access pattern is unusual, treat the event as a potential precursor to broader compromise and review nearby authentication, file access and remote execution events before dismissing it as routine.
Practitioner takeaway: Event ID 5140 is most useful when you read it as a relationship event, not just a file-share event, because the real signal is whether the actor, source and share combination makes operational sense.