Event ID 5145 helps identify suspicious access to network shares, including reconnaissance, staged payload access, and lateral movement through file shares. It records share-level checks, so failures only appear when the share itself denies access. Review Share Name, Relative Target Name, Source Address, and Accesses, and enable Audit Detailed File Share to make the event available.
Which attacks does Event ID 5145 actually surface?
event id 5145 is most useful for spotting Windows share access telemetry that fits reconnaissance, staged payload access, and lateral movement through file shares. The event is share-level, so it tells you who asked for what on the share, not necessarily whether the file was opened or modified. That makes it a detection signal for intent and access pattern, not proof of successful execution.
In practice, the suspicious patterns are usually repeated Share Name and Relative Target Name checks, unusual Source Address values, access attempts against admin or staging shares, and bursts of requests that do not match normal user workflows. Because the event records share-level checks, failed access is only visible when the share itself denies the request, so investigators should treat 5145 as an access path indicator and correlate it with process, logon, and file activity rather than reading it in isolation.
For defenders, the value of 5145 is in context. A single access can be normal, but repeated lookups across many names, especially from a host that does not usually touch that share, can indicate discovery before theft or deployment. If the share exposes scripts, installers, admin tools, or data staging areas, the same event can also mark the handoff point where an attacker moves from access to action.
What the event fields tell you during investigation
The four fields called out in the direct answer, Share Name, Relative Target Name, Source Address, and Accesses, are the core of triage. Share Name tells you which shared resource was targeted, Relative Target Name narrows the path inside the share, Source Address points to the origin host, and Accesses shows the requested operation. Together they let you distinguish ordinary file browsing from more suspicious enumeration or repeated access attempts.
Reviewing those fields also helps separate human activity from machine-driven activity. A workstation user checking a document share may produce a small, predictable set of events. By contrast, a compromised host often generates broader lookup patterns, unusual timing, or access to locations that align with internal tooling, backups, staging folders, or administrative content. That is where 5145 becomes especially useful alongside other telemetry sources.
If you already have Sysmon detection coverage, pair 5145 with process creation and network connection evidence to understand what happened before the share access and what followed it. The share event alone rarely proves the whole attack chain, but it often gives you the first reliable breadcrumb for file-share based movement.
How to turn 5145 into a practical detection signal
Start by baselining which hosts, accounts, and services normally access each share, then look for outliers. Shares used for software distribution, administration, or data exchange often have legitimate machine traffic, so the question is not simply whether 5145 exists, but whether the source, path, and access pattern fit the normal business use of that share. A sudden spike in lookups or access attempts is more meaningful than an isolated request.
Enable the audit setting that makes the event available, then tune collection so you can actually retain and search it at the volume you expect. Share telemetry is easy to under-collect because it is verbose and noisy, yet it is one of the few Windows signals that can reveal the discovery phase of a share-based intrusion. If you are already watching for credential abuse or lateral movement, 5145 should sit in that detection chain rather than in a separate silo.
Events that matter most are usually the ones that combine an unusual source with access to a sensitive share, especially where the access pattern suggests reconnaissance first and payload staging second. That is also why file-share monitoring belongs in the broader attack-chain view captured in The State of NHI & AI Agent Breach Report 2026, where stolen access and lateral movement repeatedly show up as the practical bridge between initial compromise and deeper impact.
Risk and Threat Considerations
Event ID 5145 is valuable because it can expose the point where an attacker starts using legitimate file-share access as an exploration or delivery channel. The risk is not the event itself, but the fact that share-level checks can reveal reconnaissance, staging, and lateral movement before those actions become visible in higher-level application or endpoint data.
Failure mechanism: An attacker uses valid access, or a stolen credential, to enumerate shares and probe paths that look normal at the protocol level. Because 5145 records share-level checks, defenders may see many small access attempts without immediately seeing the later file activity or the full purpose of the interaction.
Impact: The organisation can miss early movement toward payload staging, tool transfer, or internal discovery, especially when the same account and source host also look plausible in routine operations. That increases dwell time and makes later containment harder, because the first observable signal may already be after the attacker has identified useful shares.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | Share-based lateral movement often uses remote file access paths. |
| T1083 — File and Directory Discovery | Repeated share path checks indicate discovery of internal file locations. | |
| Recommendation — Correlate share access with remote-service activity to detect lateral movement. Hunt for repeated share enumeration and path discovery across hosts. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Event 5145 depends on audit collection and retention to be useful. |
| Recommendation — Enable and retain detailed file share auditing for investigation coverage. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Share telemetry depends on generating the right audit records. |
| AU-6 — Audit Record Review, Analysis, and Reporting | The event is actionable only when analysts review patterns and anomalies. | |
| Recommendation — Configure audit generation for detailed file share events. Review 5145 events for anomalies in source, path, and access type. | ||
Practitioner Guidance
What to verify: Confirm whether the source host, account, and accessed share are normal for that business function before treating 5145 as suspicious. If the share hosts admin tools, deployment files, or staged data, a single unusual lookup deserves more attention than it would on a generic collaboration share.
Decision rule: If 5145 shows repeated access to many files or paths from a host that has no clear operational need, escalate to lateral-movement investigation and correlate with authentication, process, and file-write evidence. If the event is isolated and fits a known automation pattern, document the baseline and keep it under watch rather than forcing a high-severity response.
Practitioner takeaway: Treat 5145 as a share-access breadcrumb, not a standalone verdict, and use it to decide whether a host is merely browsing or is actively mapping the path for movement, staging, or theft.