Windows Security Event 5145 is the Windows audit event for detailed network share access. It logs attempts to access files or folders over SMB, including the share name, relative path and requested access, which helps track lateral movement, file staging and unauthorised access to shared resources.
How Windows Security Event 5145 Works
Windows Security Event 5145 is a share-level audit event, so it records the attempted access before anyone necessarily opens a file. That makes it valuable for seeing which network share, subpath and requested operation were targeted, even when the action later fails or is only partially completed.
The event is especially useful in SMB environments because the share is often the first boundary an attacker, insider or misconfigured application touches. A 5145 record helps separate ordinary browsing from more specific access attempts, such as reading sensitive data, writing staging files or probing administrative shares.
What 5145 Reveals in Practice
At a practical level, 5145 gives defenders a structured view of who asked for what on a shared resource. The relative path and requested access fields help distinguish broad share access from attempts against a particular folder, file pattern or operational area, which is useful when reconstructing file-server activity.
That detail matters because share access is often noisy. Without the event context, a successful SMB connection can look similar whether it was a normal user opening documents, a backup process enumerating content, or a suspicious actor mapping a directory tree in preparation for staging or exfiltration.
For deeper file-server context, use the Windows File Server and NTFS Permissions Guide to see how share permissions, NTFS permissions and 5145 auditing fit together on Windows file servers.
How Security Teams Use 5145 Data
Security teams usually treat 5145 as correlation data, not as a standalone verdict. It becomes much more useful when paired with logon activity, process creation, file object auditing and endpoint telemetry, because the event shows the share interaction while other logs show the source host, user context and subsequent behaviour.
That is why baseline knowledge of Windows logging matters. The Windows Event Log Guide provides the broader event ID landscape, while the SIEM Guide explains how to turn these records into usable detections and alert logic.
When response time matters, triage tools and log-forwarding design also shape whether 5145 data is actually available at scale. The Hayabusa and Chainsaw Guide is useful for fast event-log analysis, and the Windows Event Forwarding Guide shows how to collect Windows event data centrally.
Why 5145 Matters for Detection and Investigation
5145 often becomes important when an investigation needs to prove intent, not just connectivity. It can help distinguish benign user access from reconnaissance, shared-folder abuse or staging activity, especially when the same host makes repeated access attempts across multiple paths or shares.
It also supports investigation of file-server abuse in identity-heavy environments, where over-permissioned users, service accounts or reused credentials can create broad file access paths. For a wider detection lens, the Endpoint Telemetry Guide helps place Windows auditing alongside other host telemetry, while the Identity Visibility, Posture and Threat Detection Guide shows how access events fit into attack-path and response thinking.
For logging discipline and retention, the NIST SP 800-92 Log Management Guide is a good companion when organisations need to preserve audit data long enough for reconstruction and review.
Risk and Threat Considerations
Event 5145 is most valuable where SMB shares contain sensitive or operationally important data, because attackers and insiders often use shared folders for discovery, staging and lateral movement. If share auditing is incomplete, organisations may see the connection but miss the exact file or folder path that was targeted.
Failure mechanism: A compromised account, mis-scoped service identity or overexposed share can generate legitimate-looking access records while still enabling reconnaissance, bulk access or file placement that should not have been possible.
Impact: Defenders may lose visibility into early abuse of shared storage, miss staging before exfiltration or ransomware deployment, and struggle to prove which resources were touched during the compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Windows share access auditing depends on generating detailed audit records for SMB activity. |
| AU-6 — Audit Record Review, Analysis, and Reporting | 5145 is mainly useful when teams review and correlate audit records for suspicious share access. | |
| Recommendation — Enable AU-12 coverage for share auditing so 5145-style access attempts are recorded. Apply AU-6 to review share-access events for abnormal or unauthorized access patterns. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The term is fundamentally about Windows audit logging and central review of share-access events. |
| Recommendation — Centralize and retain Windows share-access logs so 5145 events can support investigations. | ||
| MITRE ATT&CK | T1021.002 — SMB/Windows Admin Shares | 5145 helps detect adversary use of SMB shares during lateral movement and staging activity. |
| Recommendation — Map suspicious SMB share access to T1021.002 and investigate lateral movement paths. | ||
| NIST CSF 2.0 | DE.CM-03 — Detect unauthorized personnel, connections, devices, and software | 5145 supports monitoring for unauthorized share connections and access attempts. |
| Recommendation — Use DE.CM-03 to monitor for unauthorized SMB share access and investigate anomalies. | ||
Practitioner Guidance
Why practitioners should care: Treat 5145 as a share-access signal that only becomes operationally useful when it is tied to a clear file-server audit design. The event is strongest when you know which shares matter, which paths should rarely be touched and which identities should never request broad access.
What to watch for: Repeated access to unusual relative paths, access attempts that do not match the user’s role, or access patterns that look like enumeration rather than ordinary document use are strong review triggers.
Practitioner takeaway: Use 5145 to confirm who reached which share path, then validate that the access was expected against permissions, business need and the rest of the Windows telemetry.
Related resources from NHI Mgmt Group
- How should security teams improve Windows logon auditing when native Event Viewer is too manual for compliance and forensics?
- Why do provider-aware Windows event mappings matter for security operations?
- How should security teams validate that Windows event normalisation is working?
- How should security teams choose between Windows Event Forwarding and an OpenTelemetry collector for central log collection?